CVE-2026-106931: SiteGuard Server Edition OS Command Injection Runs as root or SYSTEM

Background

SiteGuard Server Edition is a host-based web application firewall from EG Secure Solutions, a Japanese vendor. It installs as a module on the web server itself, with editions for Apache httpd, Nginx and IIS. That placement is the reason this bug matters. The WAF sits in the request path of the application it protects, and its management and statistics components run with high privileges on the same host.

CVE-2026-106931 is an OS command injection flaw (CWE-78) in the product’s statistics function. According to the vendor, successful exploitation lets an attacker run arbitrary OS commands with root or SYSTEM privileges on the server. The vendor states that exploitation has already been confirmed. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 20 October 2026.

Technical Mechanism

The vendor advisory and the public CVE record classify the issue as CWE-78: input handled by the statistics function ends up in an operating system command without adequate neutralisation. The CVSS 4.0 base score is 8.5, and the CVSS 3.0 base score is 7.8.

Two details are worth separating from speculation. First, the vendor says exploitation depends on the statistics feature being active, and that the feature is enabled by default. Second, the public sources we checked do not agree on how the attacker reaches the function. One secondary source describes the attacker as local, while the vendor advisory and the BleepingComputer report do not state whether local or remote access is required. We have not seen a published proof of concept or technical write-up, so we cannot describe the injection point, the vulnerable parameter or the request format. Treat any detailed exploit walkthrough you encounter as unverified until it cites the vendor or JPCERT/CC.

Real-World Exploitation Evidence

The vendor says abuse has been confirmed, and it notified customers with direct support contacts on 29 September, according to BleepingComputer. JPCERT/CC issued a warning in mid-October that the flaw is being exploited. CISA’s KEV entry marks known ransomware campaign use as “Unknown” and sets forensic triage to “Yes”.

What is not public: the actor, the number of victims, the exploitation technique and any indicators of compromise. Neither the vendor nor JPCERT/CC has published them, and the reporting we found contains no IOCs. If a source offers hashes or IP addresses for this CVE, check it against the vendor advisory before acting on it.

Impact Assessment

An attacker who succeeds gets root on Linux and BSD hosts or SYSTEM on Windows, on the machine running the web server. That means control of the WAF, of the web application behind it and of anything reachable from that host: configuration files, TLS private keys, application secrets and database credentials. A compromised WAF can also be used to weaken its own rules or hide later activity.

Sectors that deploy SiteGuard, primarily Japanese organisations, face the highest exposure. The CISA listing means US federal agencies must act by the due date, but the product’s user base is mostly outside that scope.

Affected Versions

For customers who cannot upgrade, including end-of-support versions, the vendor provides a patch that replaces the files used for statistics processing.

Remediation Steps

1. Preserve evidence first. The vendor warns that updating or patching may erase attack traces. In the web admin console, use the diagnostic information download (診断情報 > 診断情報をダウンロード) and store the archive off the host before you change anything.
2. Update to Ver 8.00 Update 5 (Apache, Nginx, IIS) or Ver 7.00 Update 6 (FreeBSD Apache and Nginx).
3. If you cannot upgrade, apply the vendor’s statistics-file replacement patch. This route covers end-of-support versions.
4. Treat exposed hosts as potentially compromised. Given confirmed exploitation and the CISA forensic triage flag, assume that any host running an affected version that was reachable for the past few weeks needs review, not only patching.
5. Rotate secrets held on the host (TLS keys, application and database credentials) if review finds signs of compromise.

The vendor lists no mitigation other than updating or the replacement patch. We have not seen a supported way to disable the statistics function as a workaround, so do not assume turning it off is safe without checking with the vendor.

Detection Guidance

No public IOCs exist, so detection rests on behaviour. These are our recommendations, not vendor guidance.

• Process ancestry. Look for shells or interpreters (sh, bash, cmd.exe, powershell.exe) spawned by the web server process or the SiteGuard statistics components. A WAF module has no routine reason to launch them.
• Web and WAF logs. Review requests to statistics or management endpoints from unexpected source addresses, especially unusually long parameters or shell metacharacters (;, |, backticks, $()).
• Persistence. On Linux, check cron entries, new SSH keys, new users and recently modified files under the web root. On Windows, check new services, scheduled tasks and local accounts.
• Egress. Alert on outbound connections from the web server to hosts it has never contacted.
• Vendor diagnostic archive. Keep it for incident response, as the vendor advises.

Timeline

References

• EG Secure Solutions: SiteGuard Server Edition security alert
• BleepingComputer: Hackers exploit SiteGuard WAF flaw to run commands as SYSTEM or root
• NVD: CVE-2026-106931
• CISA: BOD 26-04