[Urgent] SiteGuard Server Edition CVE-2026-106931: Update to Ver8.00 Update5 (CVSS v4.0 8.5) — Exploitation Confirmed; Save the Diagnostic Info Before Updating

The statistics feature of SiteGuard Server Edition, a Japanese host-based WAF, has a flaw that lets an attacker run arbitrary OS commands on the server as root or SYSTEM. It is CVE-2026-106931. The vendor, EG Secure Solutions, said on 14 October 2026 that exploitation has already been confirmed, and CISA added it to KEV (its catalog of known exploited vulnerabilities) on 20 October. JPCERT/CC writes that it has confirmed the product is widely used in Japan.

You are affected if you run Ver2.20 or later with the statistics feature enabled (it is enabled by default). The fixed versions are Ver8.00 Update5 for the Apache, Nginx and IIS editions and Ver7.00 Update6 for the FreeBSD editions (Apache and Nginx).

Before updating, download and keep the "diagnostic information". The vendor warns that updating or patching can erase traces of an attack. After updating, also consider investigating whether you were already compromised (JPCERT/CC).

Where this score comes from. 8.5 is the CVSS v4.0 value assigned by JPCERT/CC, the CNA, with the vector `CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N` (local, low privileges required, no user interaction). The vendor and JVN also give 7.8 (HIGH) under CVSS v3.0. NVD itself had not scored it as of 21 October 2026 (its status is "Deferred"). This article uses the v4.0 value of 8.5 in the box and shows the v3.0 value beside it. The weakness type is CWE-78 (OS command injection).

Note the words "local" and "low privileges required". The score assumes the attacker already holds some access on the server. Even so, the vendor has confirmed exploitation, and the actual entry point has not been published (see "What I could not confirm").

What to do now

• ✓★Find out whether SiteGuard Server Edition is installed on your servers. It is a WAF built into the web server, so ask the web server administrator. If it is installed, is Ver2.20 or later, and the statistics feature is on, you are affected (the feature is on by default). On the IIS edition, Ver3.10 to Ver4.00 Update4 are not affected
• ✓Before updating, save the "diagnostic information". Per the vendor, in the web admin screen go to [Diagnostic information] → [Download diagnostic information]. Updating or patching can erase traces of an attack, so do this first (vendor, JPCERT/CC)
• ✓Update to a fixed version. Ver8.00 Update5 for the Apache, Nginx and IIS editions; Ver7.00 Update6 for the FreeBSD Apache and Nginx editions
• ✓If you cannot update, apply the vendor's patch. It replaces the files used for statistics processing and is available even for end-of-support versions (vendor)
• ✓If you can neither update nor patch right away, disable the statistics feature. JPCERT/CC says this avoids the vulnerability. Check the vendor's latest guidance for how (I could not confirm the procedure, so it is not given here)
• ✓Consider an investigation for compromise. JPCERT/CC writes "consider carrying out countermeasures and an investigation for compromise". The public sources I found list no specific indicators of compromise. For servers reachable from the internet, I suggest reviewing web server and admin logs, unfamiliar processes and accounts, and file changes with a specialist firm (our note)
• ✓If you have a support contract, check that you saw the notice. The vendor says it notified customers with direct support contracts individually on 29 September 2026

Affected versions and fixes (from the vendor and JVN)

• ▸Affected: SiteGuard Server Edition Ver2.20 and later with the statistics feature enabled, earlier than the fixed versions below
• ▸Apache, Nginx and IIS editions: earlier than Ver8.00 Update5 are affected; fixed in Ver8.00 Update5
• ▸FreeBSD editions (Apache, Nginx): earlier than Ver7.00 Update6 are affected; fixed in Ver7.00 Update6
• ▸Not affected: the IIS edition from Ver3.10 to Ver4.00 Update4
• ▸SiteGuard Proxy Edition (gateway type) and SiteGuard Cloud Edition (cloud type) are not listed as affected. The vendor's notice covers Server Edition only

What the flaw does

• ▸Where and what: the statistics feature has an OS command injection (CWE-78). If it succeeds, arbitrary OS commands may run as root or SYSTEM on the server where the product runs (vendor, JVN)
• ▸Why it matters that this is a WAF: a WAF is placed to protect a web server. If the protective product itself is vulnerable and gets compromised, the website and data on that server can be affected (our note)
• ▸Exploitation: the vendor and JVN say exploitation has been confirmed. CISA's assessment recorded in NVD is exploitation "active", automatable "no", technical impact "total". Ransomware use is "Unknown" in the KEV field

Timeline

• ▸29 September: the vendor individually notified customers with direct support contracts of the flaw and countermeasures (vendor, JVN)
• ▸14 October: the vendor published its notice ("Critical"). JVN#88474777 and JPCERT/CC's alert (JPCERT-AT-2026-0032) appeared the same day, and NVD recorded the CVE that day
• ▸20 October: CISA added it to KEV. The federal due date recorded in NVD is 23 October. It applies to US federal agencies and does not bind organisations in Japan, but it shows how urgent CISA considers it

What I could not confirm

• ▸Who is exploiting it, since when, and how. None of the vendor, JPCERT/CC or CISA publishes the attack path, timing or scale. The public sources I checked list no indicators of compromise
• ▸The exact procedure to disable the statistics feature. JPCERT/CC names it as a workaround but points to the vendor's latest guidance, and I could not confirm the steps
• ▸How the "local" attack condition is met in real attacks. The score assumes the attacker already has access on the server; the sources do not say how that was achieved in the exploitation the vendor confirmed
• ▸NVD's own score. As of 21 October 2026 NVD has not completed its assessment (status: Deferred)
• ▸The number of victims in Japan. JPCERT/CC says the product is widely used in Japan, but no victim count is published

Three lines to share

• ▸SiteGuard Server Edition, a Japanese WAF (Ver2.20 or later, statistics feature on), has a flaw that lets an attacker run OS commands as root or SYSTEM (CVE-2026-106931, CVSS v4.0 8.5). The vendor confirmed exploitation and CISA added it to KEV on 20 October
• ▸★Before updating, save the "diagnostic information" from the admin screen. Then update to Ver8.00 Update5 (Ver7.00 Update6 for FreeBSD) or apply the vendor's patch. Updating or patching can erase traces of an attack
• ▸If you cannot update right away, disable the statistics feature (JPCERT/CC's workaround). Consider an investigation for compromise even after updating