ATTACKERS are actively exploiting CVE-2026-106931 in SiteGuard Server Edition, with JPCERT/CC warning that the OS command injection flaw can grant root or SYSTEM privileges. SiteGuard Server Edition is an on-host web application firewall from EG Secure Solutions, and the vulnerability resides in its statistics feature, which is enabled by default. An attacker with low-level local access can inject OS commands through the feature, potentially taking control of the underlying server. JVN notes that exploitation has been observed in the wild, and several groups have corroborated active use.
Affected products include SiteGuard Server Edition Ver2.20 and later (when the statistics feature is on); IIS editions from Ver3.10 to Ver4.00 Update 4 are not affected. The flaw is rated CVSS 8.5 (v4) and has been described as an OS command injection that may allow arbitrary commands to be executed with root or SYSTEM privileges. Public disclosure followed a vendor alert issued on 29 September 2026, and exploitation signals indicate some servers may have been compromised before defenders were aware.
Patches are available: Ver8.00 Update 5 for Apache httpd, Nginx and IIS; Ver7.00 Update 6 for Apache httpd and Nginx on FreeBSD; and the vendor patch can be applied to end-of-life versions if upgrade isn’t possible. Administrators are advised to back up diagnostic data and apply the patch promptly, as updating may erase attack traces.