Attackers are exploiting an OS command-injection vulnerability, CVE-2026-106931, in SiteGuard Server Edition, a host-based web application firewall (WAF) from the Japanese vendor EG Secure Solutions. A WAF sits in front of a website to filter malicious requests, so a flaw that lets an attacker run commands through it hands over the very server it was meant to protect. According to the vendor and JPCERT/CC, a successful attack can execute arbitrary commands with root or SYSTEM privileges on the machine running the product.
The flaw sits in the product’s statistics feature, which is enabled by default. The vendor says abuse has already been confirmed, and JPCERT/CC lists it as exploited in the wild. Neither advisory says who is behind the attacks, who was hit, or how widespread they are, and BleepingComputer notes the same. The vendor says it notified customers with direct support contracts on September 29, and published its public alert on October 14. The JVN entry rates the flaw CVSS 4.0 base score 8.5 (CVSS 3.0: 7.8), while the vendor labels it critical.
How to check if you’re affected
Affected versions are SiteGuard Server Edition 2.20 and later, with the statistics feature enabled (the default). Per the vendor and JPCERT/CC:
- Apache httpd, Nginx and IIS editions: versions before 8.00 Update 5 are vulnerable (fixed in 8.00 Update 5).
- Apache httpd and Nginx editions on FreeBSD: versions before 7.00 Update 6 are vulnerable (fixed in 7.00 Update 6).
- IIS editions 3.10 through 4.00 Update 4 are not affected.
- If you cannot upgrade, the vendor provides a patch that replaces the files used in statistics processing, including for end-of-life versions.
Before updating or patching, download the “Diagnostic information” from the web management interface (Web management screen, then Diagnostic information, then Download diagnostic information) and keep it. The vendor warns that applying the fix may erase traces of an attack, and you will want that evidence if you need to investigate a possible compromise.
This is a different product from the SiteGuard WP Plugin for WordPress; the advisories cover only SiteGuard Server Edition.