Pulp-style warning robot with a red beacon examining a glowing red bug through a magnifying glass

SiteGuard Server Edition CVE-2026-106931: exploited, save the diagnostics before you patch

ALERT · Actively exploited. Last updated 26 October 2026. See the Alert Tracker

A local attacker with low privileges can abuse an OS command injection in the statistics feature (on by default) to run commands as root or SYSTEM. CVSS 4.0 8.5 (High). The vendor confirms exploitation, and fixes are out. Download the diagnostic information before you touch it.

What it is

SiteGuard Server Edition is a host-based web application firewall from the Japanese vendor EG Secure Solutions. The vendor’s alert of 14 October (opens in a new tab) (in Japanese, marked “Urgent”) says CVE-2026-106931 is an OS command injection in the statistics feature, and that exploitation has already been confirmed. JVN#88474777 (opens in a new tab) carries the same details in English.

The attacker must already be on the server: the vendor’s score is for a local attack needing low privileges. In practice, that means anyone who already has a low-privileged foothold on a protected web server, for example through a compromised web application, can use the WAF to take over the machine. Do not read it as a flaw exploitable from the network edge.

CISA added it to the Known Exploited Vulnerabilities catalogue (opens in a new tab) on 20 October, the same day as Siemens Software Center. The federal due date, 23 October, has already passed.

Scores

  • CVSS 4.0: 8.5 (High), vector AV:L/AC:L/AT:N/PR:L/UI:N, from the vendor and JPCERT/CC as the CNA.
  • CVSS 3.0: 7.8 (High), shown unchanged on NVD (opens in a new tab).

Who is affected

  • Affected: Ver2.20 and later are affected; the IIS edition Ver3.10 to Ver4.00 Update4 is not.
  • In detail: Apache, Nginx and IIS editions before Ver8.00 Update5, and FreeBSD Apache and Nginx editions before Ver7.00 Update6.
  • Condition: the statistics feature must be enabled. It is on by default.

What to do

  • Before anything else, download the diagnostic information and keep it. The vendor warns that updating or patching may erase traces of the attack. In the web admin console, go to Diagnostic information (診断情報), then Download diagnostic information (診断情報をダウンロード).
  • Update. Ver8.00 Update5 fixes the Apache, Nginx and IIS editions (excluding FreeBSD). Ver7.00 Update6 fixes the FreeBSD Apache and Nginx editions.
  • Or patch. The vendor offers a file-replacement patch for those who can’t upgrade, including end-of-support versions. Customers with support contracts were told directly on 29 September; others should go through their support contact or reseller.
  • Investigate the host. Because this is a step to root or SYSTEM, ask how a low-privileged attacker could have reached the server in the first place. Review the protected web applications, local accounts and recent changes on any server where the statistics feature was on.
  • If you cannot update at once (our inference, not vendor guidance): the vendor ties the flaw to the statistics feature, so turning that feature off may be a stopgap. The vendor itself offers only the update or the patch, so check with your support contact first.

Sources

Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)