2026-10-24
SiteGuard Server Edition CVE-2026-106931 exploited: who is affected and what to do
On October 14, 2026, EG Secure Solutions disclosed CVE-2026-106931, an OS command injection vulnerability in the statistics feature of SiteGuard Server Edition, its host-based web application firewall (WAF), and said exploitation has already been confirmed. Exploitation may allow arbitrary OS commands to run with root or SYSTEM privileges on the server running the product. Affected are Ver2.20 and later with the statistics feature enabled (it is enabled by default): the Apache, Nginx and IIS editions before Ver8.00 Update5, and the FreeBSD Apache and Nginx editions before Ver7.00 Update6. The IIS edition Ver3.10 through Ver4.00 Update4 is not affected. The fixes are Ver8.00 Update5 and Ver7.00 Update6; for systems that cannot be upgraded, a patch is available, including for end-of-support versions. The vendor rates the flaw as local attack vector with low privileges required (CVSS v3.0 7.8, v4.0 8.5). JPCERT/CC issued an alert, saying it has confirmed the product is widely used in Japan, and that disabling the statistics feature avoids the issue. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on October 20 with a due date of October 23. This site's conclusion: if you run Server Edition, check the version and the statistics feature today, save the diagnostic data before updating, then apply the fixed version or the patch.