SiteGuard Server Edition (Japanese WAF) CVE-2026-106931: OS command injection in the statistics feature, on by default, is being exploited; root/SYSTEM command execution, fixed in 8.00 Update5 and FreeBSD 7.00 Update6

EG Secure Solutions disclosed on 14 October 2026 an OS command injection vulnerability, CVE-2026-106931 (JVN#88474777), in the statistics function of SiteGuard Server Edition, a host-based web application firewall widely used in Japan for Apache, Nginx and IIS. The vendor says exploitation has already been confirmed. A successful attack lets an attacker run arbitrary OS commands with root or SYSTEM privileges on the server running the product. Affected are version 2.20 and later with the statistics feature enabled, which is the default: Apache, Nginx and IIS editions before Ver8.00 Update5, and FreeBSD Apache and Nginx editions before Ver7.00 Update6. IIS Ver3.10 through Ver4.00 Update4 are not affected. The vendor rates it CVSS 4.0 8.5 (CVSS 3.0 7.8) with a local attack vector and low privileges required. It notified customers with direct support contracts on 29 September and offers a replacement-file patch for those who cannot upgrade, including end-of-support versions. JPCERT/CC issued an alert the same day, noting the product is widely used in Japan and urging both patching and compromise checks. The vendor warns that upgrading may wipe attack traces, so collect the diagnostic information from the web admin console before updating. Primary: EG Secure Solutions; JPCERT/CC alert; wire: The Hacker News ThreatsDay (16 Oct).

Product

EG Secure Solutions SiteGuard Server Edition (Apache, Nginx, IIS; FreeBSD Apache/Nginx)

Versions

Ver2.20 and later with statistics enabled (default): Apache/Nginx/IIS before Ver8.00 Update5; FreeBSD Apache/Nginx before Ver7.00 Update6. IIS Ver3.10–Ver4.00 Update4 not affected.

CVSS

8.5 (CVSS 4.0, vendor) / 7.8 (CVSS 3.0, vendor)

Exploited in Australia?

unknown

Patch to

Upgrade to Ver8.00 Update5 (Apache/Nginx/IIS, non-FreeBSD) or Ver7.00 Update6 (FreeBSD). If you cannot upgrade, apply the vendor's statistics-file replacement patch or disable the statistics feature. Before updating, collect the 'diagnostic information' bundle from the SiteGuard web console to preserve attack traces, then hunt for web shells and new accounts on the host.

Primary: EG Secure Solutions — SiteGuard Server Edition OS command injection vulnerability (urgent), CVE-2026-106931 (14 Oct 2026, Japanese) · Vendor: JPCERT/CC alert JPCERT-AT-2026-0032 — SiteGuard Server Edition CVE-2026-106931 (14 Oct 2026, Japanese) · CVE: CVE-2026-106931 · The Hacker News — ThreatsDay bulletin: SiteGuard WAF command injection exploited (16 Oct 2026)

vulnerabilities network