Attackers are exploiting an OS command injection vulnerability in SiteGuard Server Edition, a web application firewall (WAF) from the Japanese vendor EG Secure Solutions. The flaw is tracked as CVE-2026-106931 and lets attackers run arbitrary operating system commands with root or SYSTEM privileges. It sits in the product's statistics feature, which is enabled by default. The vendor and Japan's JPCERT/CC both say the flaw has been exploited in the wild.

EG Secure Solutions and the Japan Vulnerability Notes (JVN) portal published coordinated advisories on October 14, 2026. Customers with direct support contracts had been notified two weeks earlier, on September 29. Fixed releases are available, along with a file-replacement patch for installations that cannot be upgraded, including end-of-life versions. The vendor also asks administrators to collect diagnostic data before they update or patch, because doing so may erase traces of an attack.

The vulnerability

JVN#88474777 (JVNDB-2026-000148) classifies the bug as CWE-78, improper neutralization of special elements used in an OS command. JPCERT/CC issued a related alert under JPCERT-AT-2026-0032. The JVN entry scores the flaw as follows:

  • CVSS v4.0: 8.5 (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
  • CVSS v3.0: 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Both vectors describe a local attack vector that needs low privileges and no user interaction, with high impact on confidentiality, integrity, and availability. The numeric base scores fall in the "High" band, but JVN labels the flaw's overall severity as Critical. BleepingComputer reports the same critical rating from the vendor's bulletin and from JPCERT/CC. Confirmed exploitation and commands that run as root on Unix-like hosts or as SYSTEM on Windows help explain why the advisories rate it above its base scores. Command execution at that privilege level gives an attacker full control of the host running the WAF.

Exploitation requires the statistics function to be active. Because that function is on by default, any installation that was never reconfigured should be treated as exposed.

Who is affected

According to the JVN advisory and the vendor alert, the affected products are:

  • SiteGuard Server Edition Ver2.20 and later, with the statistics feature enabled, running versions earlier than Ver8.00 Update 5 (Apache httpd, Nginx, and IIS editions, excluding FreeBSD) or earlier than Ver7.00 Update 6 (Apache httpd and Nginx on FreeBSD).
  • Exception: the IIS edition from Ver3.10 through Ver4.00 Update 4 is not affected.

The fixed versions are:

  • Ver8.00 Update 5 for Apache httpd, Nginx, and IIS (excluding FreeBSD)
  • Ver7.00 Update 6 for Apache httpd and Nginx on FreeBSD

For deployments that cannot move to a fixed release, EG Secure Solutions provides a patch that replaces the files used in statistics processing. The vendor says the patch is also available for end-of-life versions.

SiteGuard says it protects more than 1.5 million websites, BleepingComputer reports. The outlet also notes that WordPress.org shows about 500,000 active installations of the separate SiteGuard WordPress plugin. The advisories list only SiteGuard Server Edition as affected, not that plugin. Site owners who run only the WordPress plugin should not assume this vulnerability applies to them. If their hosting provider runs SiteGuard Server Edition, they should ask the provider about its patch status.

Timeline

  • September 29, 2026: According to JVN and the vendor, the developer notifies customers with direct support contracts.
  • October 14, 2026: EG Secure Solutions publishes its security alert, and JVN publishes JVN#88474777. Both state that exploitation has been confirmed.
  • October 18, 2026: BleepingComputer reports on the active exploitation and quotes the vendor: "Abuse has already been confirmed."

The sources do not say when the exploitation was first detected. Customers who buy SiteGuard through a distributor, a hosting provider, or another indirect channel may not have received the September 29 notice. They should check with their supplier rather than assume they were informed.

What is not known

None of the published sources identify the attackers, name any victims, give the scale of the activity, or describe the methods used. BleepingComputer reports that all of these remain unknown and that neither advisory provides these details. The advisories do not include indicators of compromise, and the sources reviewed for this article make no attribution to any group or country. The sources also do not mention a listing in CISA's Known Exploited Vulnerabilities catalog. Without such a listing, no federal remediation due date applies at the time of writing.

The local attack vector in the CVSS scoring raises a question the advisories do not answer: how attackers obtained the access needed to reach the vulnerable function. ZeroDayFeed will not speculate on that, and defenders should not assume a particular entry point when they scope an investigation.

What It Means for Defenders

The vendor's recommended order of operations matters because of the warning about evidence loss. Follow it in sequence:

  1. Collect diagnostic information first. Before you update or apply the patch, download diagnostic information from the SiteGuard web administration console and store it. EG Secure Solutions warns that updating or patching may erase traces of an attack. If you skip this step, you may lose your only evidence of whether the server was compromised.
  2. Update to a fixed release. Move to Ver8.00 Update 5 (Apache httpd, Nginx, IIS) or Ver7.00 Update 6 (Apache httpd/Nginx on FreeBSD).
  3. Apply the file-replacement patch if you cannot upgrade. The vendor's patch replaces the statistics processing files and covers end-of-life versions, so systems running EOL builds still have a fix available.
  4. Contact support or JPCERT/CC. The vendor directs customers to its support desk (via their contract documents or distributor) or to JPCERT/CC.

Other steps follow from what the advisories say:

  • Inventory every SiteGuard Server Edition deployment, including instances that hosting providers or managed service partners run for you. Confirm the version and whether the statistics feature is enabled. Leaving it at its default means it is on.
  • Treat unpatched, exposed hosts as potentially compromised. Exploitation has been confirmed, and the commands run as root or SYSTEM. Patching closes the hole, but it does not remove anything an attacker may already have planted. Review the collected diagnostics and host logs for unexpected processes, new accounts, scheduled tasks, or changed files on the web server.
  • Rotate credentials stored on or reachable from affected servers if you find signs of compromise or cannot rule it out. That includes service accounts, database credentials, TLS private keys, and administrative passwords. Root or SYSTEM access means anything on the host should be considered readable.
  • Watch for vendor and JPCERT/CC updates. No indicators of compromise have been published yet. If EG Secure Solutions or JPCERT/CC release IOCs or detection guidance, check them against your historical logs, not only against new traffic.
  • Check the CISA KEV catalog. If CISA adds CVE-2026-106931, U.S. federal agencies will have a remediation due date, and other organizations can use it as a benchmark for their own patching timeline.

The incident also illustrates a broader point. Security software that sits in the request path often runs with the highest privileges on the hosts it protects. When a flaw in a default-on feature of that software is exploited, the attacker can gain control of the whole host, not just the web application it protects.

Sources