Exploited in the wildHIGHCISA KEV

Exploited SiteGuard Server Edition command injection can run commands as root

An OS command injection in the statistics feature of EG Secure Solutions' SiteGuard Server Edition lets attackers run commands as root or SYSTEM, and the vendor has confirmed exploitation. Preserve diagnostic data, then update or patch.

EG Secure Solutions SiteGuard Server EditionCVE-2026-106931CVSS7.8CWE-78Web & app servers
Published Oct 22, 2026

EG Secure Solutions and JVN report confirmed in-the-wild exploitation 1,2. CISA added the CVE to KEV on 2026-10-20 with a 2026-10-23 due date 4. No public source names actors, a start date or IOCs.

Sep 29, 202624 daysOct 23, 2026

What you need to know

  • Affected: SiteGuard Server Edition Ver2.20 and later, before Ver8.00 Update 5 (Apache, Nginx, IIS) or Ver7.00 Update 6 (FreeBSD), with statistics on (the default). IIS Ver3.10 to Ver4.00 Update 4 are not affected.
  • Impact: OS command injection runs arbitrary commands as root or SYSTEM. CVSS 3.0 is 7.8, scored as local access with low privileges.
  • The vendor has confirmed in-the-wild exploitation. The CVE has been in CISA KEV since 2026-10-20, with a federal due date of 2026-10-23.
  • Fix: update to Ver8.00 Update 5 or Ver7.00 Update 6, or apply the vendor's file-replacement patch, which also covers EOL versions. Disabling statistics is a stopgap.
  • Before patching, download the diagnostic information from the admin console. Updating can erase traces of an attack.

What's happening

SiteGuard Server Edition is a host-based web application firewall from EG Secure Solutions that runs inside Apache httpd, Nginx and IIS. CVE-2026-106931 is an OS command injection flaw in its statistics feature 1,2. An attacker who exploits it can run arbitrary operating system commands with root or SYSTEM privileges on the server running the product 1,2. Only installations with the statistics feature enabled are affected, and the feature is enabled by default 1. JPCERT/CC notes that the product is widely used in Japan 3.

The vendor states that exploitation has already been confirmed, and JVN and JPCERT/CC repeat that finding 1,2,3. CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2026-10-20 4. It set a remediation due date of 2026-10-23 for federal agencies and flagged the CVE as requiring forensic triage 4. None of the advisories names the attackers, says when exploitation began, or counts affected systems. The vendor privately notified direct-support customers on 2026-09-29, ahead of public disclosure on 2026-10-14 1,2. Whether attacks predate either date is not established.

How it works

The bug is a CWE-78 OS command injection in the product's statistics feature 1,2. Neither the vendor nor JVN describes the injection point or the input that reaches it 1,2. The vendor's patch works by swapping out the files used for statistics processing 1,2.

The vendor and JVN score the flaw at CVSS 3.0 7.8 with AV:L/AC:L/PR:L/UI:N, meaning local access, low privileges and no user interaction 1,2. They also publish a CVSS 4.0 base score of 8.5 1,2. That local rating does not explain confirmed in-the-wild exploitation. The advisories do not say how attackers reach the vulnerable code, including whether traffic handled by the protected web server can feed into it 1,2. Do not treat the local vector as a limit on exposure until the vendor clarifies the attack path.

Exposure depends on version and configuration. Affected releases run from Ver2.20 up to the fixed builds, and only when the statistics feature is enabled, which is the default 1. On IIS, Ver3.10 through Ver4.00 Update 4 are not affected 1.

What to do

In order of priority
  1. 1

    First preserve the diagnostic information from the admin console 1. Then update to Ver8.00 Update 5 for Apache httpd, Nginx and IIS, or Ver7.00 Update 6 for Apache httpd and Nginx on FreeBSD 1.

  2. 2

    If upgrading is not practical, apply the vendor's patch that replaces the statistics-processing files. The patch is also available for end-of-life versions 1,2.

  3. 3

    As a stopgap, disable the statistics feature. JPCERT/CC says this avoids the vulnerability and refers users to the vendor for the steps 3. The vendor's public advisory does not include them, so ask vendor support.

  4. 4

    Restrict local and administrative access to SiteGuard hosts and the web admin console to trusted administrators. The published vector requires local access with low privileges 1,2.

  5. 5

    Because exploitation is confirmed, investigate affected hosts for compromise as JPCERT/CC advises 3. Successful exploitation gives root or SYSTEM privileges 1. If you find signs of compromise, consider rebuilding the host and rotating the credentials, keys and certificates stored on it.

  6. 6

    US federal agencies must apply vendor mitigations, following the BOD 26-04 forensic triage requirements, by 2026-10-23. If mitigations are unavailable, they must stop using the product 4.

Detection

  • Before updating or patching, download the diagnostic information from the web admin console (診断情報 > 診断情報をダウンロード). The vendor warns that updating or patching may erase traces of an attack 1.
  • Inventory SiteGuard Server Edition installations and versions across Apache httpd, Nginx, IIS and FreeBSD hosts. Check whether the statistics feature is enabled on each one, since it is on by default 1.
  • Treat every affected host that ran with statistics enabled as a candidate for compromise assessment. JPCERT/CC advises a compromise investigation alongside mitigation, and the CISA KEV entry marks forensic triage as required 3,4.
  • No IOCs, log patterns or scanner templates have been published. As a generic hunt on affected hosts, look for shells or interpreters spawned by web server or SiteGuard processes running as root or SYSTEM. Also check for new accounts, cron entries, scheduled tasks, services and web shells.
  • Ask the vendor's support channel whether customer-only guidance includes detection indicators. The public advisories reviewed contain none.

Timeline

  1. The vendor privately notifies direct-support customers of the flaw and the countermeasures (upgrade or individual patch). 1

  2. The vendor publishes an urgent public alert stating that exploitation has been confirmed. 1

  3. JVN publishes JVN#88474777 and JPCERT/CC issues alert JPCERT-AT-2026-0032. 2

  4. The vendor advisory page is updated. The changes are not documented. 1

  5. CISA adds CVE-2026-106931 to the Known Exploited Vulnerabilities catalog. 4

  6. CISA KEV remediation due date for US federal agencies. 4

Sources

  1. 1
    SiteGuard Server EditionにおけるOSコマンドインジェクションの脆弱性(緊急)
    EG Secure Solutions · Vendor · Oct 14, 2026
  2. 2
    JVN#88474777: SiteGuard Server Edition vulnerable to OS command injection
    JPCERT/CC and IPA (JVN) · Government · Oct 14, 2026
  3. 3
    JPCERT-AT-2026-0032: SiteGuard Server Editionの OSコマンドインジェクションの脆弱性(CVE-2026-106931)に関する注意喚起
    JPCERT/CC · Government · Oct 14, 2026
  4. 4
    CISA Known Exploited Vulnerabilities catalog entry for CVE-2026-106931
    CISA · Government · Oct 20, 2026

Confirmed by vendor and government. Researched and drafted by the VulnDigest briefs agent from 4 sources, then checked against them by a separate review step on Oct 22, 2026.

The vendor confirmed exploitation. JVN and JPCERT/CC relay that statement rather than reporting independent evidence, and no third-party research or telemetry has been published.

No public exploit or proof of concept was found in the sources reviewed.

The attack path is undocumented: the vendor scores the flaw as local with low privileges, yet it has been exploited in the wild.

Severity is HIGH based on CVSS 3.0 7.8 and CVSS 4.0 8.5. JVN labels the issue Critical and the vendor labels it urgent.

CISA KEV details (date added, due date, forensic triage flag, BOD 26-04) come from CISA's KEV data feed; the catalog page could not be loaded when this brief was checked.

Spotted an error? Open an issue on sochub.io.