EG Secure Solutions SiteGuard Server Edition · Exploitation confirmed

Command injection in SiteGuard WAF already exploited, vendor says

Oct 19, 2026 · 1 min read

An OS command injection flaw (CVE-2026-106931) affects EG Secure Solutions' SiteGuard Server Edition WAF, versions 2.20 and later with the statistics function enabled, which is the default. The vendor states the flaw is already exploited and fixed it in Ver8.00 Update5 and Ver7.00 Update6 (FreeBSD). Update or patch now; first download the diagnostic information from the web console to preserve attack traces.

By HIFY Radar newsroom Updated 10/26/2026 01:20 PM Get this every day →← Back to the feed 3 sources

HighVulnerabilityExploitation confirmedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

EG Secure Solutions, maker of the Japanese SiteGuard Server Edition WAF, disclosed an OS command injection flaw (CVE-2026-106931) on 2026-10-14 and stated it is already being exploited. The flaw allows running commands with root or SYSTEM privileges on the server. A fixed version and a patch are available.

Why it matters

Installations from version 2.20 onward with the statistics function enabled, the default setting, are exposed. An attacker can run arbitrary commands with maximum privileges on the server running SiteGuard. The product is a WAF, the very tool meant to protect the environment.

What to do

Update immediately to the fixed version or apply the vendor patch. Before that, download the diagnostic information from the web admin console, because the fix can erase attack traces. Investigate the servers for signs of compromise.

For the technical team

CVE: CVE-2026-106931
Affected: EG Secure Solutions SiteGuard Server Edition · SiteGuard Server Edition Ver2.20 and later with statistics enabled: Apache, Nginx, and IIS editions before Ver8.00 Update5; FreeBSD (Apache and Nginx) before Ver7.00 Update6. Stated exception: IIS Ver3.10 through Ver4.00 Update4 is not affected.
Exploitation: Exploitation confirmed by the vendor in the 2026-10-14 advisory ('abuse has already been confirmed'). The incident record reports CISA KEV listing; the attached CISA source describes a different CVE (CVE-2026-111497, Google Brotli) and does not confirm this listing. Support-contract customers were notified on 2026-09-29.
Fix: Apache, Nginx, and IIS: update to Ver8.00 Update5 (excluding FreeBSD). FreeBSD Apache and Nginx: Ver7.00 Update6. A patch replaces the file used for statistics processing and is available for end-of-support versions too. Before applying, download the 'diagnostic information' from the web console ([診断情報] - download) to preserve traces, which the fix may erase.
Vector: OS command injection (CWE-78) in the statistics function of SiteGuard Server Edition. Exploitable when the statistics function is enabled (default: enabled). Vendor CVSS metrics show local attack vector (AV:L) with low privileges required (PR:L); impact is arbitrary OS command execution as root or SYSTEM on the server running the product. CVSS 4.0 base 8.5; CVSS 3.0 base 7.8.
More details: Tracked as JVN#88474777; vendor contact: support desk or JPCERT/CC. NVD record started 2026-10-20. Radar incident opened 2026-10-26. The provided CISA source (KEV) covers CVE-2026-111497 in Google Brotli, added 2026-10-27, unrelated to this case in the sources.