Attackers Exploit SiteGuard WAF Flaw CVE-2026-106931 for Root Access

Threat actors are actively exploiting CVE-2026-106931, an operating system command injection vulnerability in SiteGuard Server Edition, according to an urgent alert from EG Secure Solutions. This Japanese web application firewall runs directly on the servers it protects, and the flaw allows attackers to execute commands with root or SYSTEM privileges.

The vulnerability impacts the product’s statistics feature, which is enabled by default, meaning most installations are exposed without additional configuration. EG Secure Solutions confirmed that exploitation is occurring in the wild, granting attackers high-level control over the underlying server infrastructure where the firewall is deployed.

Context and Background

The vendor and Japan’s Vulnerability Note (JVN) rated the flaw with a CVSS 4.0 score of 8.5 and a CVSS 3.0 score of 7.8, classifying it as high severity. According to Cyber Security News, the weakness is categorized as OS command injection under CWE-78, allowing command execution through the statistics-processing function.

Exploitation requires local access and low-level privileges, suggesting the flaw serves as a privilege escalation path after an attacker has already gained initial access to the system. The vendor notified customers with direct support contracts on September 29, 2026, while the public alert and JVN advisory were published on October 14.

JPCERT/CC coordinated the disclosure and issued its own alert, while the vendor reported the vulnerability to Japan’s Information-technology Promotion Agency (IPA). Customers without direct support contracts received the warning approximately two weeks after the initial notification, creating a staggered timeline for awareness.

Who Is Affected

The vulnerability affects SiteGuard Server Edition version 2.20 and later, specifically when the statistics function is enabled. For Apache, Nginx, and IIS editions running on non-FreeBSD systems, any version prior to 8.00 Update 5 is vulnerable. FreeBSD installations using Apache or Nginx are affected if they are running versions before 7.00 Update 6.

IIS editions from version 3.10 through 4.00 Update 4 are not affected by this vulnerability. Administrators must verify both their installed version and whether the statistics feature is active to accurately assess their exposure. Many details regarding the attackers, affected organizations, and exact exploitation methods remain unknown.

What should you do?

The vendor offers a patch that replaces the files used in statistics processing, which is available for affected versions, including those that have reached end-of-life. This option provides a remediation path for organizations that cannot immediately upgrade to the latest software releases.

Administrators are advised to download and save diagnostic information before applying any update or patch. The vendor warns that remediation may erase traces of an attack, so preserving this data is critical for forensic analysis and determining if the server was compromised prior to the fix.

What to do and how to stay safe: SiteGuard

• Verify if your SiteGuard Server Edition version is affected by checking against the specific version thresholds for your operating system and web server platform.
• Ensure the statistics feature is disabled if you cannot immediately apply the vendor’s patch or upgrade to the recommended secure versions.
• Download and securely store diagnostic information from your web management screen before performing any updates to preserve potential evidence of compromise.
• Monitor system logs for unusual command executions or privilege escalation attempts, as the vulnerability requires local access to exploit.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-106931?

It is an OS command injection vulnerability in SiteGuard Server Edition that allows attackers to run commands with root or SYSTEM privileges.

Which versions of SiteGuard are affected?

Version 2.20 and later are affected, with specific update requirements for Apache, Nginx, and IIS editions depending on the operating system.

Is there a fix available?

Yes, the vendor provides a patch that replaces statistics processing files, available for affected versions including end-of-life releases.