SiteGuard WAF Flaw CVE-2026-106931 Exploited in Attacks

EG Secure Solutions disclosed on Wednesday that attackers are exploiting an OS command injection vulnerability in SiteGuard Server Edition, its host-based web application firewall, to run commands with root or SYSTEM privileges.

Tracked as CVE-2026-106931, the flaw carries a CVSS v4 score of 8.5 (7.8 under CVSS v3) and sits in the product’s statistics feature, which ships enabled by default. Japan Vulnerability Notes rates the issue critical in its advisory, and JPCERT/CC issued an emergency alert the same day, noting that the WAF is widely deployed across Japan.

SiteGuard Server Edition installs directly into Apache, Nginx, or IIS web servers and filters traffic before it reaches the application. The bug is classed as CWE-78, improper neutralization of special elements in an OS command, which means crafted input reaching the statistics feature ends up being executed by the operating system. The vendor has not said which input the feature mishandles.

The CVSS vector rates the attack as local, requiring low privileges and no user interaction. An attacker therefore needs some existing access to the server first, then uses the flaw to turn that limited foothold into full control, since the injected commands run as root on Linux and FreeBSD or as SYSTEM on Windows.

JVN states that the vulnerability “has been confirmed to be exploited in the wild.” Neither EG Secure Solutions nor JPCERT/CC has named the attackers, said how many customers were compromised, or explained how the initial access was obtained.

Every release from Ver2.20 onward is affected until the fixed builds. That covers Apache, Nginx, and IIS editions before Ver8.00 Update 5, and the FreeBSD Apache and Nginx editions before Ver7.00 Update 6. IIS editions from Ver3.10 through Ver4.00 Update 4 are not affected.

The Tokyo-based developer reported the flaw to Japan’s Information-technology Promotion Agency (IPA) itself, and JPCERT/CC coordinated the disclosure. EG Secure Solutions privately notified customers with direct support contracts on September 29, two weeks before the public advisory, and gave them the upgrade and an individual patch.

For organizations that cannot upgrade, the company offers a patch that replaces the files used in statistics processing, and it is available for end-of-life versions as well. JPCERT/CC says disabling the statistics feature also blocks the attack.

The vendor’s alert carries a forensic warning: updating or patching may erase traces of an intrusion. Administrators are told to first download the diagnostic data from the web management console, under Diagnostic Information, and keep it before applying the fix. JPCERT/CC recommends that affected organizations run a compromise investigation alongside the update.