SiteGuard Server Edition CVE-2026-106931: exploited flaw runs commands as root, now in CISA KEV

Updated 21 October 2026: expanded with the full timeline, per-edition versions, hosting providers, incident response steps and an "Am I affected?" check.

What happened

On 14 October 2026, EG Secure Solutions published an urgent advisory for SiteGuard Server Edition. It fixes CVE-2026-106931, an OS command injection flaw. JVN and JPCERT/CC published the same day.

The vendor says the flaw is already exploited. An attacker may run OS commands with root or SYSTEM privileges on the server. Root is the top account on Linux and FreeBSD. SYSTEM is the top account on Windows.

On 20 October 2026, CISA added the CVE to its Known Exploited Vulnerabilities catalog. US federal agencies must act by 23 October 2026.

What SiteGuard Server Edition is

SiteGuard Server Edition is a host-based web application firewall (WAF). It is software from the Japanese firm EG Secure Solutions. It runs as a module inside Apache httpd, Nginx or IIS, on the web server it protects. It inspects HTTP and HTTPS requests against attack signatures.

The vendor sells three licences: standard, managed and proxy. The proxy licence runs it on an Apache or Nginx reverse proxy in front of other servers.

The product was called SiteGuard Lite before Ver4.00 in April 2019, according to the Japanese site Innovatopia. Older installs may still carry that name.

Who uses it

JPCERT/CC says it has confirmed the product is widely used in Japan.

Japanese hosting providers bundle it:

• Sakura Internet offers it free on its VPS, cloud and dedicated server plans. Customers install and set it up themselves.
• IDC Frontier uses it as the standard WAF of its Zenlogic hosting service. There it is on by default for each domain.

Sakura Internet published Ver8.00 Update 5 for its cloud on 15 October and for its VPS on 20 October 2026. If you installed SiteGuard through a provider, check which build you run.

Timeline

• 30 April 2015: Ver2.20 ships. It is the oldest affected version, per the vendor's version table.
• 29 September 2026: The vendor releases the fixed builds. The same day it warns customers with direct support contracts.
• 14 October 2026: Public advisory from the vendor, JVN (JVN#88474777) and JPCERT/CC (JPCERT-AT-2026-0032). The CVE record goes live.
• 15 and 20 October 2026: Sakura Internet ships the fix to its cloud and VPS users.
• 20 October 2026: CISA adds the CVE to KEV, with five other bugs.
• 23 October 2026: CISA due date for US federal agencies.

Customers without a direct support contract learned of the flaw about two weeks after supported customers, as Security Affairs points out.

Affected and fixed versions

All affected builds start at Ver2.20, and only when the statistics feature is on. It is on by default.

• Apache httpd, Nginx and IIS editions: affected before Ver8.00 Update 5. Fixed in Ver8.00 Update 5.
• Apache httpd and Nginx on FreeBSD: affected before Ver7.00 Update 6. Fixed in Ver7.00 Update 6.
• IIS edition Ver3.10 to Ver4.00 Update 4: not affected.
• End-of-life builds: the vendor offers a patch that replaces the statistics processing files. It works on unsupported versions too.

The vendor's table lists Ver6.00 and older as out of support. Ver7.00 to Ver7.00 Update 3, and the Ver7.00 IIS builds, lose support on 30 November 2026.

How an attack works

The vendor scores the flaw CVSS 4.0 8.5 and CVSS 3.0 7.8, both High. JVN marks it urgent (緊急). Innovatopia explains JVN adds that label when attacks are already seen.

The score says the attacker needs local access and low privileges on the server. In plain words: the attacker must already be able to run something on the machine, even as a weak user. The bug then lets them reach root or SYSTEM.

No source says the flaw can be hit straight from the internet. Security Affairs says this suggests it is used after an attacker already has a foothold. Innovatopia notes that such bugs are generally used to raise privileges after another way in. Neither says how the real attacks started.

What is known about the attacks

• Confirmed: the vendor, JVN and JPCERT/CC say the flaw is exploited. CISA lists it in KEV.
• Unknown: who the attackers are, who was hit, how many servers, and when attacks began.
• Unknown: the first-stage entry point. No public source names one.
• Ransomware: CISA lists known ransomware use as unknown.
• PoC: ThreatWire found no public proof of concept. No exploit steps are public.
• Credit: the developer reported the flaw to IPA. JPCERT/CC coordinated. No outside researcher is named.

Detection and incident response

Save evidence before you patch. The vendor warns that updating or patching may erase attack traces. Before any change, open the SiteGuard web admin screen. Go to Diagnostic information and download it. Keep the file.

JPCERT/CC asks every affected user to consider a compromise investigation, not just a patch. A clean server after the update does not prove it was clean before.

CISA flags this CVE for forensic triage. Its directive BOD 26-04 sets when US federal agencies must check whether attackers got in before the patch.

Practical next steps, based on those warnings:

• Keep the diagnostic file and your web server logs together.
• Review the server for accounts, files or scheduled jobs you do not recognise.
• If you suspect a breach, isolate the host and bring in incident response before you rebuild it.

Mitigation

1. Save diagnostic information first.
2. Update to Ver8.00 Update 5. On FreeBSD, update to Ver7.00 Update 6.
3. Patch with the vendor's file-replacement patch if you cannot update. It covers end-of-life versions.
4. Disable the statistics feature if you cannot do either yet. JPCERT/CC says this avoids the flaw. Ask the vendor for the steps.
5. Plan off end-of-life builds. Older versions only get the stopgap patch.

Am I affected?

• Do you run SiteGuard Server Edition or SiteGuard Lite? Check your web servers and your hosting plan. Sakura and Zenlogic customers may have it.
• Is your version Ver2.20 or later? Builds before Ver2.20 are not listed as affected.
• Is it below the fix? Below Ver8.00 Update 5, or Ver7.00 Update 6 on FreeBSD, means affected.
• IIS Ver3.10 to Ver4.00 Update 4? Not affected.
• Is statistics on? It is on by default. Confirm the setting; do not assume.

If you answered yes to the first three and statistics is on, you are affected. Treat the server as possibly breached until you check.

Related on ThreatWire

See the full record for CVE-2026-106931. Another exploited KEV entry this autumn is the NetScaler command execution flaw (CVE-2026-88771). Browse all actively exploited CVEs and the CVE tracker.

Sources: the EG Secure Solutions advisory, supported-versions table and product page, JVN#88474777, JVN iPedia, JPCERT/CC alert JPCERT-AT-2026-0032, the CISA alert and KEV catalog, NVD, CVE.org, GitHub advisory GHSA-rhmj-5mp2-rq7c, Sakura Internet and IDC Frontier pages, BleepingComputer, Security Affairs and Innovatopia. Links are in the references list.