Attackers exploit SiteGuard WAF flaw to run commands as root or SYSTEM

Attackers are exploiting a command injection vulnerability in SiteGuard Server Edition, a host-based web application firewall (WAF) developed by Japan's EG Secure Solutions, to execute commands with root or SYSTEM privileges. According to BleepingComputer, both the vendor and Japan's computer emergency response team JPCERT/CC have warned that the flaw, tracked as CVE-2026-106931, is being abused in the wild. The issue matters because a security product meant to shield web servers can itself become a path to full control of the host.

What happened

Daily CyberSecurity reports that JPCERT/CC issued its warning on October 14, 2026, stating that exploitation of the flaw had been confirmed. According to BleepingComputer, the vendor's alert is listed as alert-202610-1 and JPCERT/CC's advisory as JVN88474777.

The disclosure came in stages. EG Secure Solutions first notified customers with direct support contracts on September 29, 2026, and public advisories followed roughly two weeks later, Daily CyberSecurity notes. The publication points out that some servers may therefore have been compromised before most administrators knew the flaw existed.

Neither the vendor nor JPCERT/CC has disclosed who is behind the attacks, how many servers were affected, or what attackers did after gaining access, according to both outlets. BleepingComputer notes that SiteGuard claims to protect more than 1.5 million websites.

Technical details

The vulnerability resides in the statistics function of SiteGuard Server Edition, which is enabled by default. Daily CyberSecurity reports that the flaw is rated 8.5 under CVSS v4 and that it allows an attacker with low-privileged local access to inject operating system commands, which are then executed as root or SYSTEM. Exploitation requires the statistics function to be active.

According to BleepingComputer, affected products include:

• SiteGuard Server Edition for Apache httpd, Nginx and IIS (excluding FreeBSD), from version 2.20 up to, but not including, 8.00 Update 5
• SiteGuard Server Edition for Apache httpd and Nginx on FreeBSD, from version 2.20 up to, but not including, 7.00 Update 6

IIS editions from 3.10 through 4.00 Update 4 are not affected, per JPCERT/CC. Daily CyberSecurity reports that no public proof-of-concept exploit had been detected at the time of writing, and the flaw is not currently listed in CISA's Known Exploited Vulnerabilities catalog.

Who is affected

Organizations running SiteGuard Server Edition on Apache httpd, Nginx or IIS servers with the default statistics feature enabled are at risk. Because the product is primarily deployed in Japan, Japanese web hosting providers and enterprises are likely to be the most exposed, though any installation of an affected version should be treated as vulnerable.

What to do

• Before updating, preserve evidence. The vendor warns that remediation may erase traces of an attack and recommends downloading diagnostic information from the web management interface (Web management screen > Diagnostic information > Download diagnostic information) and storing it safely.
• Upgrade to SiteGuard Server Edition 8.00 Update 5, or 7.00 Update 6 on FreeBSD for Apache and Nginx.
• If an upgrade is not possible, including on end-of-life versions, apply the vendor's patch that replaces the files used in statistics processing.
• Given that exploitation predates public disclosure, review affected hosts for signs of compromise, such as unexpected processes, new accounts or unfamiliar scheduled tasks, rather than assuming a patched server is clean.