Loading vulnerability…
CVE-2026-106931 is an OS command injection vulnerability in the statistics function of SiteGuard Server Edition, a host-based web application firewall. Exploitation can execute arbitrary operating system commands with root or SYSTEM privileges. The statistics function is enabled by default. Affected versions begin at 2.20 and precede 8.00 Update 5 for Apache httpd, Nginx, and IIS editions outside FreeBSD, and precede 7.00 Update 6 for Apache httpd and Nginx editions on FreeBSD. IIS versions 3.10 through 4.00 Update 4 inclusive are not affected. Exploitation in the wild has been confirmed.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
33 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical OS command injection vulnerability in SiteGuard Server Edition Web Application Firewall affects host-based instances with the statistics function enabled, the default configuration. Attackers can execute arbitrary commands with root or SYSTEM privileges. The vendor and Japan’s national CERT have confirmed real-world exploitation. A vendor patch is available; disabling the statistics function is an interim mitigation.
An actively exploited OS command injection vulnerability in the statistics feature of SiteGuard Server Edition, which is enabled by default. Exploitation requires local access and low-level privileges and permits command execution as root or SYSTEM. The reported severity is CVSS 4.0 8.5 and CVSS 3.0 7.8. Affected releases begin at version 2.20: non-FreeBSD Apache, Nginx, and IIS editions before 8.00 Update 5, and FreeBSD Apache or Nginx editions before 7.00 Update 6. IIS versions 3.10 through 4.00 Update 4 are excluded. Only installations with statistics enabled are exposed. Fixed releases and replacement-file patches, including patches for end-of-life versions, are available. Administrators should preserve diagnostic information before remediation because updating or patching may erase attack evidence. Attackers, victims, attack methods, and the number of affected systems are not identified.
A critical OS command-injection vulnerability in SiteGuard Server Edition’s statistics feature allows attackers to execute commands with root or SYSTEM privileges. Exploitation is confirmed in the wild, but attackers, victims, attack scale, and exploitation methods are undisclosed. The statistics feature must be active and is enabled by default. Affected non-FreeBSD Apache httpd, Nginx, and IIS editions span version 2.20 through versions before 8.00 Update 5; affected FreeBSD Apache httpd and Nginx editions span version 2.20 through versions before 7.00 Update 6. IIS versions 3.10 through 4.00 Update 4 are explicitly unaffected. Fixed releases and replacement-file patches, including patches for end-of-life versions, are available. Administrators should preserve diagnostic information before remediation because updating or patching may erase attack traces.
An OS command injection vulnerability in SiteGuard Server Edition may allow arbitrary command execution with root or SYSTEM privileges. The advisory does not specify affected versions, exploitation prerequisites, or remediation.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.