SiteGuard CVE-2026-106931: Exploited WAF Flaw Hands Attackers Root, and CISA’s Deadline Is Tomorrow
Attackers are exploiting a command injection bug in SiteGuard Server Edition, a Japanese web application firewall that runs inside the web server it protects. The flaw turns limited access on that server into root or SYSTEM. CISA has given federal agencies until Friday, October 23. Before you patch, save the diagnostic bundle: the vendor warns the update can wipe the evidence.
What: CVE-2026-106931, an OS command injection (CWE-78) in the statistics feature of EG Secure Solutions’ SiteGuard Server Edition. CVSS v4.0 8.5, CVSS v3.0 7.8. JVN#88474777.
Status: The vendor and JPCERT/CC say it has been exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog on October 20, 2026.
Deadline: Friday, October 23, 2026 for U.S. federal civilian agencies. That is tomorrow.
Fix: Upgrade to Ver8.00 Update 5 (Apache, Nginx, IIS) or Ver7.00 Update 6 (Apache and Nginx on FreeBSD), or apply the vendor’s file-replacement patch. Download diagnostic information first.
Key takeaways
- SiteGuard CVE-2026-106931 is exploited and on CISA’s KEV list, with a due date of October 23, 2026. It is the nearest federal deadline from CISA’s October 20 batch.
- Versions 2.20 and later are affected when the statistics feature is on, and it is on by default. IIS editions 3.10 through 4.00 Update 4 are not affected.
- A successful attack runs commands as root on Linux and FreeBSD or SYSTEM on Windows. The WAF sits on the web server, so that means full control of the server behind it.
- The scoring says the attacker needs local, low-privilege access first. Treat it as a privilege-escalation step after a web-app foothold, not as a reason to relax.
- Collect evidence before patching. EG Secure Solutions warns that updating may erase traces of an attack. No indicators of compromise have been published.
Executive Summary
A security control on your web servers is being used to take them over.
SiteGuard Server Edition is a host-based WAF from EG Secure Solutions in Tokyo. It plugs directly into Apache httpd, Nginx or IIS. On October 14, 2026, the vendor and Japan’s JVN published an advisory for CVE-2026-106931, an OS command injection in the product’s statistics feature. Both state that exploitation has already been confirmed. The vendor had quietly warned customers with direct support contracts on September 29, roughly two weeks before the public notice.
On Tuesday, October 20, CISA added the flaw to its KEV catalog alongside four Plex Media Server bugs and a Siemens Software Center flaw. SiteGuard and two of the Plex CVEs drew the shortest deadline in the batch: October 23. DataWater covered the Plex side in our Plex2Shell CVE-2026-96652 briefing. This briefing covers SiteGuard.
Nobody has said who is exploiting it, how many servers are hit or how attackers get their first foothold. What is known: the bug is real, it is used in attacks, and it gives the highest privileges on the box.
The bottom line: find every SiteGuard Server Edition install today, download its diagnostic bundle, then upgrade or patch. Any server that was running a vulnerable build with statistics on should get a compromise review.
Why This Matters to CISOs and Security Leaders
The control sits where the damage is greatest. A host-based WAF runs on the same machine as your web application, usually with high privileges. A flaw in it does not stay at the perimeter. It gives the attacker the server, the application’s secrets and whatever that server can reach.
The “local” score can mislead triage. JVN scores the bug as local with low privileges required. Vulnerability tools that rank by network reachability may push it down the queue. But web servers are a common place for attackers to land with low privileges, through a vulnerable plugin, an upload bug or stolen credentials. One analysis reads the prerequisites the same way: the flaw is probably used after a foothold already exists (single-source inference). CISA’s listing tells you attackers are already doing this.
Japan-centric products fall through Western inventories. SiteGuard is widely used in Japan. Global organizations with Japanese subsidiaries, hosting partners or acquired businesses may run it without central security knowing. The vendor claims more than 1.5 million protected websites, according to one report (single-source).
This is the third straight week of edge and gateway flaws. Teams are still working through the Ivanti Connect Secure zero-day CVE-2026-104935 and the batch in our October 16 CISA KEV roundup. A niche WAF is easy to miss in that queue.
Ask your infrastructure lead one question today: “Do we run SiteGuard Server Edition anywhere, including Japanese subsidiaries and hosted sites?” If nobody can answer by end of day, your exposure to a flaw with a Friday deadline is unknown.
The Timeline
| Date (2026) | What happened |
|---|---|
| Unknown | Exploitation begins. Neither the vendor nor JPCERT/CC has said when. |
| Tuesday, Sept 29 | EG Secure Solutions notifies customers with direct support contracts |
| Wednesday, Oct 14 | Public vendor alert, JVN#88474777 and JPCERT/CC alert JPCERT-AT-2026-0032; CVE record published |
| Oct 18–19 | English-language security press picks up the story |
| Tuesday, Oct 20 | CISA adds CVE-2026-106931 to the KEV catalog |
| Friday, Oct 23 | CISA remediation deadline for federal civilian agencies |
The firewall was supposed to stop attackers on the web server. Now it is the step that makes them root.
Vulnerability & Exploit Analysis
What CVE-2026-106931 is
The flaw sits in SiteGuard Server Edition’s statistics feature, which collects data about the traffic the WAF inspects. Input reaching that feature is not properly neutralized before it is passed to an operating system command (CWE-78). An attacker who can reach the vulnerable path can run commands of their choice with the WAF’s privileges: root on Linux and FreeBSD, SYSTEM on Windows.
JVN’s CVSS vectors are AV:L/PR:L with no user interaction, which means the attacker needs local, low-privilege access first. Public advisories do not describe an unauthenticated remote attack, and one analysis says so explicitly (single-source). The exact trigger has not been published.
Affected and fixed versions
| Edition | Vulnerable (statistics on) | Fixed in |
|---|---|---|
| SiteGuard Server Edition for Apache httpd | Ver2.20 to before Ver8.00 Update 5 | Ver8.00 Update 5 |
| SiteGuard Server Edition for Nginx | Ver2.20 to before Ver8.00 Update 5 | Ver8.00 Update 5 |
| SiteGuard Server Edition for IIS | Ver2.20 to before Ver8.00 Update 5 (Ver3.10 through Ver4.00 Update 4 not affected) | Ver8.00 Update 5 |
| Apache httpd on FreeBSD | Ver2.20 to before Ver7.00 Update 6 | Ver7.00 Update 6 |
| Nginx on FreeBSD | Ver2.20 to before Ver7.00 Update 6 | Ver7.00 Update 6 |
If you cannot upgrade
EG Secure Solutions offers a patch that replaces the files used in statistics processing. It covers end-of-life versions too, so an unsupported build is not a reason to wait. One report citing JPCERT/CC lists turning off the statistics feature as a temporary workaround (single-source); the vendor’s own alert lists only the upgrade and the patch. The advisories list only Server Edition; no other SiteGuard product appears in them.
A local privilege-escalation bug is only as dangerous as the ways in, and web servers just got a big new one. On October 21, the PHP project shipped emergency fixes (8.5.12, 8.4.27, 8.3.36 and 8.2.35) for PHP2Shell, CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated code execution on servers running PHP. A PHP foothold runs as the web user; SiteGuard CVE-2026-106931 is exactly the kind of flaw that lifts such a foothold to root. No source has linked the two in an attack. But on an Apache or Nginx box running both unpatched, you should assume the pair works. Patch them together.
Threat Intelligence Breakdown
Attribution: Unknown. EG Secure Solutions, JVN and JPCERT/CC have not named an actor, described victims or given a count. The Hacker News reported on October 21 that no further exploitation details were available.
What is confirmed: exploitation in the wild (vendor, JVN and JPCERT/CC), and CISA’s decision to list it in KEV. The vendor’s warning that patching may erase attack traces suggests the evidence lives on the WAF host itself, likely in data the statistics feature touches. That last point is DataWater’s inference.
Indicators of compromise: None have been published by the vendor, JPCERT/CC or CISA as of today. Hunt by behavior instead: unexpected child processes of the web server or SiteGuard components, new root or SYSTEM-level scheduled tasks, new accounts, and unfamiliar outbound connections from web servers.
Enterprise Impact: What’s Actually at Risk
The web server and everything on it: root or SYSTEM access exposes application code, database credentials, API keys and TLS private keys stored on the host.
The WAF itself: an attacker with root can change or disable SiteGuard’s rules, so the protection you think you have may already be gone. Check the WAF’s configuration, not just its version.
Lateral movement: web servers often hold paths to internal databases and management networks. A rooted front end is a staging point.
Customer data and notification duties: if the server handled personal data, a confirmed compromise may start notification clocks under Japan’s APPI, GDPR, U.S. state laws or sector rules. Record when you found it and what you did.
Audit trail: for a KEV-listed flaw, be ready to show when you inventoried, when you collected evidence, when you patched and what your review found.
What Security Leaders Should Do Next
Today
- Inventory every SiteGuard Server Edition install, including subsidiaries, hosting providers and managed web platforms. Record edition, version and whether statistics is enabled.
- Download diagnostic information first: in the web management screen, go to Diagnostic information, then Download diagnostic information. Store it off the server.
- Upgrade to Ver8.00 Update 5 or Ver7.00 Update 6 (FreeBSD), or apply the vendor’s statistics-file patch, including on end-of-life builds.
- Patch PHP on the same hosts if it runs there, to close the most likely route to the foothold this flaw needs.
Within 48 hours
- Review every host that ran a vulnerable build with statistics on for unexpected processes, persistence, new accounts and changed WAF rules.
- Look at outbound traffic from web servers to unfamiliar destinations since late September.
- If anything looks wrong, treat it as an incident: isolate, rebuild from a known-good image, and rotate every credential and key the server held.
Long-term
- Put host-based security agents in your vulnerability program with the same urgency as the servers they run on.
- Do not let “local” scores bury KEV-listed bugs. Rank by known exploitation first, CVSS second.
- Ask regional vendors how they notify non-contract customers. Here, direct-support customers heard about the flaw about two weeks before the public alert.
Get zero-day alerts before they hit the headlines
DataWater’s executive threat briefing: the exploited CVEs, the deadlines and the first three actions to take.
Winners and Losers
| Better positioned | More exposed |
|---|---|
| Customers with direct support contracts, warned on September 29 | Customers who buy through resellers and learned about it from the press |
| Teams that saved diagnostic data before patching | Teams that patched first and may have erased the evidence |
| Organizations that rank vulnerabilities by KEV status | Programs that deprioritize anything scored “local” |
| IIS sites on Ver3.10 to Ver4.00 Update 4 (not affected) | Apache and Nginx sites with default statistics and unpatched PHP |
Final Executive Takeaway
SiteGuard CVE-2026-106931 is not a perimeter bug. It is a root bug on your web servers.
It is exploited, it is on CISA’s list, and the federal deadline is tomorrow. The “local” score means attackers need a toehold first, and web servers hand those out often, especially this week.
Find it. Save the diagnostics. Patch SiteGuard and PHP together. Review anything that ran exposed.
Frequently Asked Questions
What is SiteGuard CVE-2026-106931?
CVE-2026-106931 is an OS command injection flaw in the statistics feature of SiteGuard Server Edition, a host-based web application firewall made by EG Secure Solutions. It lets an attacker run commands as root or SYSTEM on the server. JVN rates it CVSS v4.0 8.5 and CVSS v3.0 7.8.
Is SiteGuard CVE-2026-106931 being exploited?
Yes. EG Secure Solutions, JVN and JPCERT/CC say SiteGuard Server Edition CVE-2026-106931 has been exploited in the wild, and CISA added it to the Known Exploited Vulnerabilities catalog on October 20, 2026. The attackers, victims and methods have not been disclosed.
Which SiteGuard Server Edition versions are affected by CVE-2026-106931?
SiteGuard Server Edition Ver2.20 and later is affected by CVE-2026-106931 when the statistics feature is on, which is the default. Apache, Nginx and IIS editions are fixed in Ver8.00 Update 5; Apache and Nginx on FreeBSD are fixed in Ver7.00 Update 6. IIS editions Ver3.10 through Ver4.00 Update 4 are not affected.
What is the CISA deadline for SiteGuard CVE-2026-106931?
CISA gave U.S. federal civilian agencies until October 23, 2026 to fix SiteGuard Server Edition CVE-2026-106931, three days after adding it to the KEV catalog on October 20. Other organizations should treat the date as a strong signal of urgency.
Can SiteGuard CVE-2026-106931 be exploited remotely without a login?
Public advisories do not say so. JVN scores SiteGuard CVE-2026-106931 as requiring local access with low privileges, so attackers likely need a foothold on the web server first. Once they have one, the flaw raises them to root or SYSTEM.
What should I do before patching SiteGuard for CVE-2026-106931?
Download SiteGuard’s diagnostic information from the web management screen (Diagnostic information, then Download diagnostic information) and store it off the server. EG Secure Solutions warns that installing the CVE-2026-106931 update or patch may erase traces of an attack.
Are there indicators of compromise for SiteGuard CVE-2026-106931?
No indicators of compromise for SiteGuard CVE-2026-106931 had been published by EG Secure Solutions, JPCERT/CC or CISA as of October 22, 2026. Hunt for unexpected processes, persistence, new accounts and changed WAF rules on hosts that ran vulnerable builds.
Sources
Primary sources: EG Secure Solutions SiteGuard security alert (alert-202610-1); JVN#88474777 (JPCERT/CC and IPA); CISA Known Exploited Vulnerabilities catalog entry for CVE-2026-106931 (KEV dates as reported by The Hacker News and the CVE record); PHP October 2026 security release. Additional reporting reviewed: BleepingComputer, The Hacker News, Security Affairs and eSecurity Planet (single-source where noted). Reflects public reporting as of October 22, 2026.
Related posts:
Squidbleed (CVE-2026-47729): Claude Mythos Found a 29-Year-Old Heartbleed-Style Memory Leak in Every...
Sophisticated Ransomware & Double/Triple Extortion: The Complete Enterprise Defense Playbook 2026
