CVE-2026-106931
SiteGuard Server Edition statistics feature OS command injection
EG Secure Solutions SiteGuard Server Edition has an OS command injection flaw in its statistics feature, on by default. It may let an attacker run OS commands as root or SYSTEM. The vendor confirms exploitation. Fixed in Ver8.00 Update 5 (Ver7.00 Update 6 on FreeBSD). CVSS 4.0 8.5. In CISA KEV since 20 October 2026, due 23 October.
By ThreatWire Desk · Published 14 Oct 2026 · Updated 21 Oct 2026
- CVSS
- 8.5
- Vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Class
- LPE
- Status
- Active Exploitation
- KEV
- Listed in CISA KEV
- 0-day
- No
- Vendor
- EG Secure Solutions
- Products
- SiteGuard Server Edition for Apache httpd, SiteGuard Server Edition for Nginx, SiteGuard Server Edition for IIS, SiteGuard Server Edition for Apache httpd on FreeBSD, SiteGuard Server Edition for Nginx on FreeBSD
- Affected
- Ver2.20 and later with the statistics feature enabled (the default). Apache httpd, Nginx and IIS editions before Ver8.00 Update 5. Apache httpd and Nginx editions on FreeBSD before Ver7.00 Update 6. IIS edition Ver3.10 to Ver4.00 Update 4 is not affected. The product was named SiteGuard Lite before Ver4.00 (April 2019).
- Fixed
- Ver8.00 Update 5 for Apache httpd, Nginx and IIS. Ver7.00 Update 6 for Apache httpd and Nginx on FreeBSD. Both released 29 September 2026. The vendor also offers a patch that replaces the statistics processing files, including for end-of-life versions. JPCERT/CC says disabling the statistics feature avoids the issue.
- CWE
- CWE-78
- Published
- 14 Oct 2026
- Updated
- 21 Oct 2026
The status above is the claim. Links do not upgrade it.
CVE-2026-106931 is an OS command injection flaw in SiteGuard Server Edition. SiteGuard is a host-based web application firewall from EG Secure Solutions. It plugs into Apache httpd, Nginx or IIS.
The bug sits in the statistics feature. That feature is enabled by default. The vendor says an attacker may run arbitrary OS commands with root or SYSTEM privileges. The weakness is CWE-78.
EG Secure Solutions, JVN and JPCERT/CC published on 14 October 2026. The vendor labels the advisory urgent (緊急). It scores the flaw CVSS 4.0 8.5 and CVSS 3.0 7.8, both High. The full vector is in the CVSS field.
The vector says the attack is local and needs low privileges. No public source says the flaw can be reached over the network without an account. This record classes it as privilege escalation for that reason.
Affected: Ver2.20 and later with statistics on. The fix is Ver8.00 Update 5 for Apache httpd, Nginx and IIS. On FreeBSD, it is Ver7.00 Update 6. IIS Ver3.10 to Ver4.00 Update 4 is not affected.
The vendor also ships a patch that replaces the statistics files. It covers end-of-life versions too. JPCERT/CC says turning off the statistics feature avoids the issue.
The vendor says exploitation is confirmed. It released the fixed builds and warned customers with support contracts on 29 September 2026, two weeks before the public advisory. No source names the attacker, the victims or the method.
CISA added the CVE to the KEV catalog on 20 October 2026. The federal due date is 23 October 2026. Known ransomware use is unknown. CISA also flags it for forensic triage.
The vendor warns that updating may erase attack traces. It asks admins to download the "Diagnostic information" from the web admin screen first.
JPCERT/CC says the product is widely used in Japan. Sakura Internet offers it free on its VPS, cloud and dedicated servers. IDC Frontier uses it as the standard WAF of its Zenlogic hosting. The product was called SiteGuard Lite before Ver4.00 in April 2019.
The GitHub advisory GHSA-rhmj-5mp2-rq7c is unreviewed and repeats the CNA scores. The developer reported the flaw to IPA. JPCERT/CC coordinated the release. NVD has not done its own analysis ("Deferred"). ThreatWire found no public PoC. Read the full explainer and response guide.