JAPAN’S SiteGuard WAF flaw CVE-2026-106931 is already being exploited
Threat actors are actively exploiting CVE-2026-106931, an OS command injection vulnerability in SiteGuard Server Edition, according to EG Secure Solutions. Successful exploitation allows attackers to run commands with root or SYSTEM privileges on the server hosting SiteGuard. The flaw affects the WAF’s statistics feature, which is enabled by default.
The vulnerability has a CVSS v4.0 score of 8.5 and a CVSS v3.0 score of 7.8. An attacker needs local access and low-level privileges, suggesting post‑compromise use rather than a distant attack. It impacts SiteGuard Server Edition version 2.20 and later. On Apache, Nginx and IIS this corresponds to anything before 8.00 Update 5, except FreeBSD; on FreeBSD with Apache or Nginx it means anything before 7.00 Update 6.
IIS editions affected are 3.10 through 4.00 Update 4, and only installations with the statistics function enabled are exposed. A vendor patch is available for systems that cannot upgrade, replacing the files used in statistics processing and covering end‑of‑life versions as well. The patch requires care: updating or patching can erase attack traces, so administrators are advised to download diagnostic information first.
The vendor’s advisory notes a short, staggered disclosure timeline: direct customers were notified on 29 September, with a public alert and JVN advisory issued on 14 October. JPCERT/CC coordinated the disclosure; attackers, victims, and precise exploitation details remain unclear. Organisations using SiteGuard should check for signs of compromise and investigate suspicious activity, while applying the patch and securing diagnostic data beforehand.