SiteGuard CVE-2026-106931: Exploited WAF Flaw Gives Root

Attackers are exploiting SiteGuard CVE-2026-106931, an OS command injection flaw in the statistics feature of SiteGuard Server Edition, a host-based web application firewall from Japan's EG Secure Solutions. Successful exploitation runs commands as root or SYSTEM on the web server. The vendor disclosed it on 14 October 2026, and CISA added it to the KEV catalog on 20 October with a 23 October deadline. Download the product's diagnostic information first, then update or apply the vendor patch.

What happened

EG Secure Solutions published an urgent alert on 14 October 2026 saying an OS command injection vulnerability had been found in the statistics function of SiteGuard Server Edition and that abuse had already been confirmed. The same day, JPCERT/CC issued alert JPCERT-AT-2026-0032 and JVN published JVN#88474777, which rates the issue Critical and repeats that exploitation in the wild has been confirmed.

The public disclosure was not the first notice. According to the vendor, customers with direct support contracts were told about the flaw and the fixes on 29 September 2026, about two weeks before the public alert. Organizations that bought SiteGuard through a reseller, or that run it without a direct support contract, may have learned about it only on 14 October or later.

CISA added CVE-2026-106931 to the Known Exploited Vulnerabilities catalog on 20 October 2026 with a due date of 23 October. The KEV entry flags the vulnerability for forensic triage under BOD 26-04, so federal agencies must look for signs of compromise, not only patch.

Neither the vendor nor JPCERT/CC has said who is exploiting the flaw, how many servers were hit or what the attackers did after gaining access. BleepingComputer, reporting on 18 October, noted the same gaps.

Which SiteGuard versions are affected

SiteGuard Server Edition installs as a module inside the web server rather than as a separate appliance. JPCERT/CC says the product is widely used in Japan. Affected builds, per the vendor and the CVE record:

SiteGuard Server Edition for Apache httpd, Nginx and IIS: Ver2.20 and later, before Ver8.00 Update 5.
SiteGuard Server Edition for Apache httpd and Nginx on FreeBSD: Ver2.20 and later, before Ver7.00 Update 6.
Exception: the IIS edition from Ver3.10 through Ver4.00 Update 4 is not affected.

A server is only vulnerable when the statistics feature is enabled. It is enabled by default, so assume it is on unless you have checked.

The advisory names only SiteGuard Server Edition; other products in the SiteGuard series are not listed. If you are unsure which edition and build you run, check the version in the product's web management screen.

Technical analysis

The flaw is classed as CWE-78, improper neutralization of special elements used in an OS command. The vendor and JVN score it CVSS 4.0 8.5 and CVSS 3.0 7.8. Both vectors are local with low privileges required (AV:L, PR:L) and full impact on confidentiality, integrity and availability.

That vector is worth reading closely. On paper it describes an attacker who already has some low-privileged access to the host, which would normally push a CVE down a patch queue. JVN still rated it Critical, and the vendor confirmed real attacks. Neither source explains how attackers met the local-access condition, so treat any foothold on a SiteGuard server, such as a compromised web application or a stolen low-privileged account, as a possible path to root or SYSTEM until you have patched.

The privilege level matters more than usual here. A host-based WAF sits in the request path of every site on the server, and the advisories confirm this flaw reaches root or SYSTEM. Code execution at that level gives an attacker the web server, its TLS keys, its configuration files and any credentials stored on the box. For background on how this class of product works, see our explainer on what a host-based WAF is and where it runs.

What to do now

The vendor's order of operations is the important part. Patching may erase the traces of an attack, so collect evidence first.

Save the diagnostic information. In the SiteGuard web management screen, open Diagnostic information and choose Download diagnostic information. Store the file off the server. The vendor and JPCERT/CC both ask for this before any update.
Capture what else you can. Snapshot the VM or take a disk image if the server is virtual, and copy web server, SiteGuard and system logs to a separate host. Our guide on how to preserve evidence before patching a server walks through the order.
Update. Move to Ver8.00 Update 5 (Apache httpd, Nginx and IIS, excluding FreeBSD) or Ver7.00 Update 6 (FreeBSD Apache httpd and Nginx).
If you cannot update, patch. The vendor ships a patch that replaces the files used in statistics processing. It is available for end-of-life versions too.
If you cannot do either today, disable statistics. JPCERT/CC lists disabling the statistics feature as a workaround that avoids the vulnerability. Follow the vendor's documentation for the steps.
Hunt. Review the period since at least 29 September for new local accounts, unexpected scheduled tasks or cron jobs, unfamiliar files in web roots and outbound connections from the web server. If you find signs of compromise, rebuild the host and rotate every secret it held, including TLS private keys.

If you only learned about this flaw this week, check how your organization receives SiteGuard advisories. Contract customers had two weeks of notice. Our piece on why vendor security advisory subscriptions matter covers how to close that gap for every product you run.

What to watch next

Expect follow-ups in three areas. First, indicators of compromise: neither advisory includes any, and JPCERT/CC has asked organizations to share information. Second, scope: the vendor has not said how many customers were hit or when exploitation began. Third, the CVE record itself: it was updated on 21 October, and the vectors or affected versions may change as more is learned.

If you run other internet-facing servers with security software installed inside them, the same lesson applies as with last month's appliance flaws: the tool meant to protect the host is part of its attack surface. Our recent piece on rebuilding before you rotate credentials after a breach applies if your hunt turns something up.