EG Secure Solutions says attackers are already exploiting an OS command injection flaw, CVE-2026-106931, in SiteGuard Server Edition, its host-based web application firewall (WAF). The flaw sits in the product's statistics feature, which is on by default. According to the vendor's alert (in Japanese) and JVN#88474777, it may let an attacker run any OS command with root or SYSTEM privileges on the server running the product. JVN describes the product as a host-based WAF "designed to be integrated into a web server", so the system at risk is the web server itself.
CISA added CVE-2026-106931 to its Known Exploited Vulnerabilities (KEV) catalog on 20 October 2026, with a remediation due date of 23 October 2026 for US federal civilian agencies. JPCERT/CC says in its alert (in Japanese) that the product is widely used in Japan, and it advises users to consider both applying the fix and investigating for compromise.
Patching alone is not enough. The vendor warns that updating or applying its patch may erase traces of an attack, so it tells customers to download the product's "Diagnostic information" first.
Technical Information
SiteGuard Server Edition is a host-based WAF that runs inside an Apache httpd, Nginx or IIS web server (JVN#88474777). The vulnerability is an OS command injection (CWE-78) in its statistics feature. The JPCERT/CC CVE record describes the impact as execution of arbitrary OS commands "with root or SYSTEM privileges on the system running the affected product" (cve.org).
Severity: JPCERT/CC, the CVE Numbering Authority (CNA), rates the flaw High: CVSS 3.0 base score 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and CVSS 4.0 base score 8.5. The vendor's alert title and the JVN advisory also carry the label 緊急 (shown as "Critical" on JVN's English page). According to JVN's guide to reading its reports, this mark means JPCERT/CC strongly recommends applying a patch or workaround immediately. JVN adds that the mark is "just a reference"; it is not a CVSS severity rating. Its vector rates the attack as local, needing low privileges on the server. None of the advisories explains how attackers reached that position in the attacks seen so far. As of 21 October 2026, NVD has not published its own score (status "Deferred") and shows only the JPCERT/CC scores.
Exploitation: The vendor and JVN say the flaw has been confirmed to be exploited in the wild. CISA lists it in KEV, and the CISA-ADP enrichment on the CVE record marks exploitation as "active". CISA's KEV entry lists known ransomware campaign use as "Unknown" and marks the entry as requiring forensic triage under its BOD 26-04 guidance. That guidance tells agencies to collect evidence before patching, because patching may destroy artifacts. No source we checked names the attackers, the targets or the scale of the attacks.
Timeline (source in brackets):
- 29 September 2026: EG Secure Solutions notifies customers with direct support contracts about the flaw and the fixes (version update or individual patch) [vendor alert; JVN].
- 14 October 2026: EG Secure Solutions publishes its alert. JVN publishes JVN#88474777 and JPCERT/CC issues alert JPCERT-AT-2026-0032. The vendor reported the flaw to IPA, and JPCERT/CC coordinated disclosure [vendor alert; JVN; JPCERT/CC].
- 14 October 2026: CVE-2026-106931 is published by JPCERT/CC [cve.org].
- 20 October 2026: CISA adds CVE-2026-106931 to KEV, with a due date of 23 October 2026 [CISA alert; KEV catalog].
Affected Product Versions
Per the vendor alert and JVN#88474777, SiteGuard Server Edition Ver2.20 and later is affected when the statistics feature is enabled (the default):
| Edition | Affected | Fixed version |
|---|---|---|
| SiteGuard Server Edition for Apache httpd, Nginx and IIS (not FreeBSD) | Ver2.20 and later, before Ver8.00 Update 5 | Ver8.00 Update 5 (vendor, JVN) |
| SiteGuard Server Edition for Apache httpd and Nginx on FreeBSD | Ver2.20 and later, before Ver7.00 Update 6 | Ver7.00 Update 6 (vendor, JVN) |
Exception: IIS editions Ver3.10 through Ver4.00 Update 4 are not affected. The advisories name SiteGuard Server Edition only and do not address other SiteGuard products.
Workaround and Mitigation
- Find every instance (Rescana guidance). Identify each web server running SiteGuard Server Edition (Apache httpd, Nginx, IIS, FreeBSD) in your own estate and with the hosting providers and MSPs that run web servers for you. Check the edition, the version and whether the statistics feature is enabled.
- Preserve evidence first. Before updating or patching, download and keep the "Diagnostic information" from the SiteGuard web management screen (Diagnostic information > Download diagnostic information). The vendor warns that updating or patching may erase traces of an attack.
- Update. Move to Ver8.00 Update 5 (Apache httpd, Nginx, IIS) or Ver7.00 Update 6 (Apache httpd and Nginx on FreeBSD), per the vendor alert and JVN#88474777.
- If you can't update, patch. For customers who cannot upgrade, the vendor provides a patch that replaces the files used in statistics processing. The vendor says the patch is also provided for end-of-life versions. For details, contact the vendor's support desk, listed in your contract documents or available through your reseller.
- Short-term workaround. JPCERT/CC says disabling the statistics feature avoids the vulnerability. Follow the vendor's instructions for the steps.
- Investigate for compromise. JPCERT/CC recommends considering an investigation for compromise. Rescana guidance: because successful exploitation gives root or SYSTEM access, treat any server that ran an affected version with statistics enabled as possibly compromised until you have reviewed the preserved diagnostic information and the host. CISA's forensic triage steps for KEV entries are a useful checklist.
Indicators of Compromise
None published. EG Secure Solutions, JVN, JPCERT/CC and CISA have not released indicators of compromise, attacker details or victim counts. The vendor's evidence-preservation step (save the "Diagnostic information" before updating) is the main forensic guidance available so far. ATT&CK mapping: none sourced.
Why this matters for vendor risk
SiteGuard Server Edition is a Japanese WAF that runs inside the web server, so it can sit in the stack of the vendors, SaaS providers, hosting companies and MSPs that run websites and web applications for you. JPCERT/CC says the product is widely used in Japan, so, as Rescana guidance, start with vendors and hosting providers that have Japanese operations. A WAF meant to protect those sites has become a way to take over the server behind them, and the vendor warns that patching can wipe the evidence. Ask your suppliers and hosting or MSP partners directly: do you run SiteGuard Server Edition anywhere? If so, have you updated or applied the vendor patch, and when? Did you save the diagnostic information and check for compromise before patching? Then follow up until each one confirms.
What we will update: We will update this post if NVD publishes its own score, if EG Secure Solutions or JPCERT/CC publish indicators or new fix details, or if CISA changes the KEV entry.
Sources
- EG Secure Solutions, "SiteGuard Server EditionにおけるOSコマンドインジェクションの脆弱性" (SiteGuard Server Edition OS command injection vulnerability, 14 Oct 2026, in Japanese): https://www.eg-secure.co.jp/siteguard/news/alert-202610-1
- JVN#88474777, "SiteGuard Server Edition vulnerable to OS command injection" (JPCERT/CC and IPA, 14 Oct 2026): https://jvn.jp/en/jp/JVN88474777/
- JPCERT/CC alert JPCERT-AT-2026-0032 (14 Oct 2026, in Japanese): https://www.jpcert.or.jp/at/2026/at260032.html
- CISA Known Exploited Vulnerabilities catalog, CVE-2026-106931: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-106931
- CISA, "CISA Adds Six Known Exploited Vulnerabilities to Catalog" (20 Oct 2026): https://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog
- CISA, BOD 26-04 Implementation Guidance (forensic triage steps): https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- NVD, CVE-2026-106931: https://nvd.nist.gov/vuln/detail/CVE-2026-106931
- CVE Record CVE-2026-106931 (cve.org): https://www.cve.org/CVERecord?id=CVE-2026-106931
Forward this to your TPRM owner: Attackers are exploiting CVE-2026-106931 in SiteGuard Server Edition, a WAF that runs inside web servers, to run commands as root or SYSTEM, and patching can erase the evidence. Ask suppliers and hosting or MSP partners whether they run SiteGuard Server Edition, whether they've patched, and when.
Want to see which of your vendors and hosting partners may be running SiteGuard Server Edition, and whether they've patched? Book a demo.
