Who this is for: administrators running SiteGuard Server Edition, a host-based web application firewall (WAF: software built into the web server that blocks attacks on web applications) made in Japan, on their own servers or VPS. This page is based on the vendor's notice, JVN, JPCERT/CC and CISA's public data. It does not cover how the attacks work.
Developing: this page will be updated as more is published
As of 11:00 UTC, October 24, 2026Not yet known
- When exploitation began, and who is behind it
- How many organisations were affected
- Whether SiteGuard Lite and other products outside Server Edition are affected
- How to disable the statistics feature (not described in the vendor's notice)
The vendor published its notice on October 14, and JVN and JPCERT/CC published their entries the same day. CISA added the flaw to KEV on October 20. None of them says when exploitation began, who is behind it, or how many victims there are. This page will be updated when the notice is revised.
What to do today (if you run Server Edition)
Check the edition, version and statistics feature
Check which edition you run (Apache, Nginx, IIS, or FreeBSD Apache or Nginx) and its version, then use the table below to see whether you are affected. Also check whether the statistics feature is enabled. The vendor says it is enabled by default. If you never changed it, assume it is on.
Download and keep the diagnostic data before updating
The vendor says applying the update or patch may erase traces of an attack. In the web admin screen, open 診断情報 (Diagnostic information) and run 診断情報をダウンロード (Download diagnostic information), as named in the vendor's Japanese notice, then store a copy off the server. If you run the product on several servers, do this on each one.
Upgrade to the fixed version
The flaw is fixed in Ver8.00 Update5 for the Apache, Nginx and IIS editions (excluding FreeBSD), and in Ver7.00 Update6 for the FreeBSD Apache and Nginx editions.
If you cannot upgrade, apply the patch
For customers who find upgrading difficult, the vendor provides a patch that replaces the file used for statistics processing. End-of-support versions are covered. Ask your support contact (shown in your contract confirmation document or by the reseller you bought from).
If neither is possible right away, disable statistics
JPCERT/CC says disabling the statistics feature avoids the issue. Check the vendor's latest information for the steps. Disabling it is not a substitute for applying the fix or the patch (our recommendation).
Check for signs of compromise
When exploitation began has not been published. Review the saved diagnostic data and the server logs for processes, files, accounts or outbound connections you do not recognise. Our guide on how to check whether your website or server was hacked walks through this. If anything looks wrong, contact the vendor's support desk or JPCERT/CC.
Are you affected? Quick reference
| What you run | Affected? (vendor notice) | Target version |
|---|---|---|
| Apache, Nginx, IIS editions: Ver2.20 or later, before Ver8.00 Update5 | Yes, if statistics is enabled | Ver8.00 Update5 |
| FreeBSD Apache, Nginx editions: Ver2.20 or later, before Ver7.00 Update6 | Yes, if statistics is enabled | Ver7.00 Update6 |
| IIS edition: Ver3.10 through Ver4.00 Update4 | Not affected | Not stated |
| Before Ver2.20 | The affected range is stated as Ver2.20 and later | Not stated |
| Statistics feature disabled | Affected only when statistics is enabled | Applying the fix still recommended (our view) |
| End-of-support versions | Affected if within the range | Patch (covers end-of-support versions) |
| SiteGuard Lite and other products | Not mentioned by the vendor, JVN or JPCERT/CC | Check your provider's notices (for example, your hosting provider) |
Versions before Ver2.20 and end-of-support versions may be missing other fixes besides this one. Even if you fall outside this flaw's range, consider moving to a supported version (our view).
1. Edition
Apache, Nginx, IIS / FreeBSD
2. Version
Ver2.20 or later, before the fix
3. Statistics
Affected if on (on by default)
What was disclosed (vendor notice)
- CVE
- CVE-2026-106931 (JVN#88474777)
- Type
- OS command injection (CWE-78) in the statistics feature
- Severity
- CVSS v3.0 7.8, v4.0 8.5 (vendor rating). Attack vector local, privileges required low, no user interaction
- Impact
- Arbitrary OS commands may run with root or SYSTEM privileges on the server running the product
- Affected
- Ver2.20 and later with statistics enabled: Apache, Nginx and IIS editions before Ver8.00 Update5; FreeBSD Apache and Nginx editions before Ver7.00 Update6
- Not affected
- IIS edition Ver3.10 through Ver4.00 Update4
- Fix
- Upgrade to the fixed version, or apply the patch that replaces the statistics processing file (end-of-support versions included)
- Exploitation
- The vendor says exploitation has been confirmed
- Advance notice
- Customers with support contracts were notified individually on September 29, 2026
According to JVN, the vendor itself reported the issue to IPA, and JPCERT/CC coordinated. JPCERT/CC says it has confirmed the product is widely used in Japan, and asks users to consider investigating for compromise as well as applying countermeasures.
CISA added CVE-2026-106931 to KEV on October 20 and set October 23 as the due date for US federal agencies. The KEV entry marks it as requiring forensic triage. Known ransomware campaign use is listed as "Unknown".
How to read the "local, low privilege" rating
The vendor's CVSS rating has a local attack vector (AV:L) and low privileges required (PR:L). That is not a rating for a flaw anyone can exploit directly from the internet. This score assumes some low-level access on the server (our reading). CISA's KEV description just says "an attacker" and does not mention this condition.
Conditions apply, but exploitation is already happening
The vendor has confirmed exploitation. It has not said how attackers obtained the required access. We recommend not deprioritising this because of the conditional rating.
In this site's view, a flaw of this kind can turn ordinary access, gained through another web application bug or a leaked account, into administrator control of the whole server. A WAF is installed to protect web applications; if the WAF itself becomes a path to administrator rights, that assumption no longer holds.
Risky practice
- Never checking the WAF's own version after installing it
- Leaving statistics on by default without knowing whether you use it
- Updating straight away without saving any traces
- Leaving general server accounts and web application permissions unreviewed
Practice that limits the damage
- Track the WAF in the same update process as other software
- Turn off features you do not use
- Save diagnostic data and logs before updating, then check for traces
- Keep server accounts and web application permissions to the minimum
For how to prioritise flaws listed in KEV, see deciding what to patch first with CVSS, EPSS and KEV. Ranking by CVSS score alone can push an exploited flaw down the list.
If you use SiteGuard Lite or another product
The vendor's notice, JVN and JPCERT/CC's alert are all written for SiteGuard Server Edition. None of them mentions SiteGuard Lite or other products. This site has not found official information that settles whether Lite is affected.
If you use the WAF as a feature of a hosting plan, the provider usually handles WAF updates. Check your provider's notices or support pages for how they are handling this flaw. For what customers should do when a provider has a problem, see when your web hosting provider is breached.
What is not yet known
| Item | Status |
|---|---|
| Active exploitation | Confirmed (vendor, CISA) |
| When exploitation began, who is behind it | Not stated |
| Number of affected organisations | Not stated |
| Public exploit code | Not mentioned (notice and KEV) |
| SiteGuard Lite and other products | Not mentioned |
| Steps to disable statistics | Not in the vendor's notice (JPCERT/CC points to the vendor's latest information) |
The number and names of organisations in Japan using this product have not been published. This site does not name any organisation based on guesswork.
Sources
- EG Secure Solutions, notice on the OS command injection vulnerability in SiteGuard Server Edition (Japanese, October 14, 2026) — eg-secure.co.jp
- JVN, "JVN#88474777: OS command injection vulnerability in SiteGuard Server Edition" (Japanese, October 14, 2026) — jvn.jp
- JPCERT/CC, alert on CVE-2026-106931 in SiteGuard Server Edition (JPCERT-AT-2026-0032, Japanese, October 14, 2026) — jpcert.or.jp
- CISA, Known Exploited Vulnerabilities Catalog (CVE-2026-106931) — cisa.gov
Update history
2026-10-24: First version, based on the vendor's notice, JVN, JPCERT/CC's alert and CISA's KEV catalog.
Read next
- Prioritising fixes: Deciding what to patch first: CVSS, EPSS and KEV
- Checking for compromise: How to check if your website or server was hacked
- If you use shared hosting: When your web hosting provider is breached
- Another urgent flaw from the same period: PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619
- Glossary: What is a backdoor? / What is CVSS?