---
title: "SiteGuard WAF CVE-2026-106931: Exploited Command Injection"
url: https://erroneo.us/security/briefs/siteguard-server-edition-cve-2026-106931-zero-day/
description: "OS command injection in SiteGuard Server Edition's statistics feature gives root/SYSTEM; exploited. Fixed in 8.00 Update 5. Save diagnostics, then patch."
type: security-brief
section: "Security Digest"
date_published: 2026-10-14
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Patch this week"
cves: ["CVE-2026-106931"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# SiteGuard WAF CVE-2026-106931: Exploited Command Injection

**Verdict: Patch this week.** If you run SiteGuard Server Edition, save its diagnostic data and patch this week, sooner on public web servers; the bug is exploited, but its local rating means attackers need a foothold first.

- **Who must act:** Organizations running SiteGuard Server Edition 2.20 or later for Apache httpd, Nginx or IIS below 8.00 Update 5 (7.00 Update 6 on FreeBSD) with the default-on statistics feature, a product JPCERT/CC says is widely used in Japan.
- **Who can relax:** Anyone not running SiteGuard Server Edition: the advisories do not list SiteGuard Proxy Edition, Cloud Edition or the SiteGuard WP Plugin, and IIS versions 3.10 through 4.00 Update 4 are not affected.
- **Affected:** SiteGuard Server Edition for Apache httpd, Nginx and IIS: Ver2.20 and later, before Ver8.00 Update 5; SiteGuard Server Edition for Apache httpd and Nginx on FreeBSD: Ver2.20 and later, before Ver7.00 Update 6; Only when the statistics feature is enabled (the default); IIS Ver3.10 through Ver4.00 Update 4 are not affected
- **Fixed:** Ver8.00 Update 5 (Apache httpd, Nginx, IIS); Ver7.00 Update 6 (Apache httpd and Nginx on FreeBSD); Vendor patch that replaces the statistics-processing files, available for end-of-life versions too
- **CVEs:** CVE-2026-106931
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Before changing anything, download the diagnostic information from the SiteGuard web admin console and store it safely; the vendor warns that updating can erase attack traces.
2. Upgrade to Ver8.00 Update 5 (Ver7.00 Update 6 on FreeBSD), or apply the vendor's statistics-file patch, which also covers end-of-life versions.
3. If you cannot upgrade or patch yet, disable the statistics feature, which JPCERT/CC says avoids the vulnerability.
4. Treat every server that ran a vulnerable build as possibly rooted and review it for persistence.
5. Contact EG Secure Solutions support or JPCERT/CC with the saved diagnostics if anything looks wrong.

### How to check if you are affected

- Have the vendor or JPCERT/CC review the saved diagnostic information; no public indicators of compromise were published as of Oct 21, 2026.
- On Linux and FreeBSD hosts, look for new root-owned cron jobs, services, accounts, SSH keys and binaries that nobody installed.
- On IIS hosts, review new services, scheduled tasks and local administrators created under SYSTEM.
- Check the web server for web shells or other low-privilege footholds, since the CVSS vector says the attacker needs local, low-privileged access first.

## What happened

On October 14, 2026, EG Secure Solutions published an urgent [alert](https://www.eg-secure.co.jp/siteguard/news/alert-202610-1) (in Japanese). It covers an OS command injection flaw, CVE-2026-106931, in the statistics feature of SiteGuard Server Edition, a host-based web application firewall that plugs into Apache httpd, Nginx or IIS. The vendor says exploitation has already been confirmed and that the flaw can run arbitrary OS commands as root or SYSTEM. Customers with support contracts were told individually on September 29. The public alert came about two weeks later, alongside [JVN#88474777](https://jvn.jp/en/jp/JVN88474777/) and a [JPCERT/CC alert](https://www.jpcert.or.jp/at/2026/at260032.html). JPCERT/CC says it has confirmed the product is widely used in Japan.

The vendor, via JPCERT/CC as CNA, scores it CVSS 4.0 8.5 and CVSS 3.0 7.8, with a *local* attack vector and *low* privileges required. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-106931) and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-106931) carry the same vectors. CISA added it to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-106931) on October 20, with an October 23 federal deadline. Its enrichment marks exploitation as active and the attack as not automatable. Neither the vendor nor JPCERT/CC has described the attackers, the victims or the entry point. [BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-exploit-siteguard-waf-flaw-to-run-commands-as-system-root/) notes those details "remain unclear."

## Who is affected

SiteGuard Server Edition Ver2.20 and later, when the statistics feature is on, which is the default:

- **Apache httpd, Nginx and IIS editions:** versions before Ver8.00 Update 5. IIS Ver3.10 through Ver4.00 Update 4 are not affected.
- **Apache httpd and Nginx on FreeBSD:** versions before Ver7.00 Update 6.

The advisories name only Server Edition. BleepingComputer cites a vendor claim of protecting more than 1.5 million websites. Its 500,000 figure comes from WordPress.org, which counts the separate [SiteGuard WP Plugin](https://wordpress.org/plugins/siteguard/), and the advisories do not list that plugin. As of October 21, the vendor's own website was down for precautionary maintenance tied to PHP's critical October security release, so its alert may not load. JVN and JPCERT/CC carry the same details.

## Do you really need to act?

If you run SiteGuard Server Edition, yes, this week. The CVSS vector means an attacker must already be able to run something on the server, or act as a low-privileged local user, before using this bug. That is not internet-wide, unauthenticated RCE. But a host WAF lives on public web servers, where a low-privileged foothold is exactly what a web application bug or web shell provides. This flaw turns that foothold into root or SYSTEM on the machine meant to protect the site. Exploitation is confirmed, and the vendor has not said when it began. So prioritize internet-facing servers and those running PHP applications you have not patched recently.

If you do not run Server Edition, there is nothing to do for this CVE.

## What to do now

1. **Preserve evidence first.** In the SiteGuard web admin console, open Diagnostic information and choose Download diagnostic information. Keep the file. The vendor warns that updating or patching may erase traces of the attack.
2. Upgrade to Ver8.00 Update 5 (Apache httpd, Nginx, IIS) or Ver7.00 Update 6 (FreeBSD). If an upgrade is hard, apply the vendor's patch that replaces the statistics-processing files. It is available even for end-of-life versions.
3. If neither can happen today, disable the statistics feature. JPCERT/CC says this avoids the vulnerability.
4. Review each server that ran an affected build for signs of compromise, starting with internet-facing ones.
5. Patch the web applications behind the WAF too, because the bug needs a local foothold that those applications may provide.

## How to tell if you were hit

No public indicators exist as of October 21, 2026, so the saved diagnostic information is your best evidence. Share it with vendor support or JPCERT/CC. On Linux and FreeBSD, look for root-owned cron entries, systemd units or rc scripts, new accounts and `authorized_keys` entries, and unfamiliar binaries in `/tmp`, `/var/tmp` or the SiteGuard install tree. On IIS servers, review new services, scheduled tasks and local administrators. Also hunt for the foothold itself: web shells and unexpected files in web roots. If the server was compromised, rebuild it and rotate the credentials and TLS keys it held.

## Timeline

- Sep 29, 2026 — EG Secure Solutions notifies customers with support contracts of the flaw, fixes and patch.
- Oct 14, 2026 — Public vendor alert, JVN#88474777, JPCERT-AT-2026-0032 and the CVE record are published.
- Oct 18, 2026 — BleepingComputer reports the exploitation.
- Oct 20, 2026 — CISA adds CVE-2026-106931 to KEV.
- Oct 23, 2026 — CISA's remediation deadline for federal agencies.

## Sources

1. [EG Secure Solutions — OS command injection vulnerability in SiteGuard Server Edition (urgent, Japanese)](https://www.eg-secure.co.jp/siteguard/news/alert-202610-1)
2. [JVN — JVN#88474777: SiteGuard Server Edition vulnerable to OS command injection](https://jvn.jp/en/jp/JVN88474777/)
3. [JPCERT/CC — JPCERT-AT-2026-0032: Alert on SiteGuard Server Edition CVE-2026-106931 (Japanese)](https://www.jpcert.or.jp/at/2026/at260032.html)
4. [CVE record — CVE-2026-106931](https://www.cve.org/CVERecord?id=CVE-2026-106931)
5. [NVD — CVE-2026-106931](https://nvd.nist.gov/vuln/detail/CVE-2026-106931)
6. [CISA — Known Exploited Vulnerabilities: CVE-2026-106931](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-106931)
7. [WordPress.org — SiteGuard WP Plugin](https://wordpress.org/plugins/siteguard/)
8. [BleepingComputer — Hackers exploit SiteGuard WAF flaw to run commands as admins](https://www.bleepingcomputer.com/news/security/hackers-exploit-siteguard-waf-flaw-to-run-commands-as-system-root/)

---
Source page: https://erroneo.us/security/briefs/siteguard-server-edition-cve-2026-106931-zero-day/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt