Attackers exploit SiteGuard WAF flaw that runs commands as root

Attackers exploit SiteGuard WAF flaw that runs commands as root

14 October 2026: EG Secure Solutions has disclosed CVE-2026-106931, an OS command injection flaw in the statistics feature of SiteGuard Server Edition, its host-based web application firewall, and says attacks using it have already been confirmed. A successful attacker can run any command on the server with root or SYSTEM rights. The statistics feature is switched on by default, and the fix is an upgrade to Ver8.00 Update5, or Ver7.00 Update6 on FreeBSD.

Japan's coordination centre JPCERT/CC issued an alert the same day and says it has confirmed that the product is widely used in the country.

Which installations are exposed

The flaw affects SiteGuard Server Edition from Ver2.20 onwards, in these builds:

• Apache, Nginx and IIS editions before Ver8.00 Update5
• FreeBSD Apache and Nginx editions before Ver7.00 Update6

The IIS edition from Ver3.10 to Ver4.00 Update4 is not affected. In every case the server is only exposed while the statistics feature is enabled, which is the default.

EG Secure scores the flaw 8.5 under CVSS 4.0 and 7.8 under CVSS 3.0. Both vectors describe a local attack needing low privileges, so the published scores suggest an attacker needs some foothold on the server first, for example a low-privilege account or a web application flaw elsewhere on the same machine. The vendor has not said how the attacks it saw began.

Save the evidence before patching

The advisory carries an unusual warning: installing the update or the patch may erase the traces of an attack. EG Secure asks customers to download the "diagnostic information" bundle from the SiteGuard web console first and keep it, and JPCERT/CC repeats that advice and asks operators to consider a compromise investigation as well as the fix. A server that was exposed before 14 October should be treated as possibly compromised until that check is done, since the attacker would have held root.

For customers who cannot upgrade, EG Secure offers a patch that replaces the files the statistics process uses, including for versions that are past end of support. Turning the statistics feature off avoids the flaw entirely, according to JPCERT/CC.

A month between private notice and public alert

EG Secure says it told customers with a direct support contract about the flaw and the fixes on 29 September, two weeks before the public advisory. Customers who buy SiteGuard through a reseller or a hosting provider, and have no direct contract, may only now be hearing about it, so it is worth asking the provider which version runs on each server.

SiteGuard is sold in three forms: the Server Edition installed on the web server itself, a Proxy Edition that sits in front of it, and a cloud service. Only the Server Edition is named in the advisory.

Sources

• EG Secure Solutions: OS command injection vulnerability in SiteGuard Server Edition (urgent), in Japanese, 14 October 2026
• JPCERT/CC: alert JPCERT-AT-2026-0032, in Japanese, 14 October 2026
• Japan Vulnerability Notes: JVN#88474777, 14 October 2026