SiteGuard WAF command-injection flaw CVE-2026-106931 is being exploited for root and SYSTEM access

TLDR

• EG Secure Solutions says exploitation is confirmed of OS command-injection flaw CVE-2026-106931 in its SiteGuard Server Edition WAF.¹²
• A successful attack runs arbitrary OS commands as root or SYSTEM on the server hosting the product.¹²
• Patch to Ver8.00 Update5 or Ver7.00 Update6, but save diagnostic information first, as updating can erase attack traces.¹²

The vendor's alert, published on 14 October, says affected installations are Ver2.20 and later of the Apache, Nginx and IIS editions before Ver8.00 Update5, and the FreeBSD Apache and Nginx editions before Ver7.00 Update6, when the statistics feature is enabled, which it is by default.¹ Fixes are Ver8.00 Update5 for the Apache, Nginx and IIS editions and Ver7.00 Update6 for FreeBSD Apache and Nginx; a file-replacement patch covers installations that cannot upgrade, and turning off the statistics feature avoids the flaw.¹² Administrators should download the "diagnostic information" from the web management screen before updating, because updating or patching can erase traces of an attack.¹² IIS editions Ver3.10 to Ver4.00 Update4 are not affected.¹² The vendor scores the flaw 8.5 under CVSS 4.0 and 7.8 under CVSS 3.0, with a local attack vector and low privileges required in both vectors.¹ The vendor labels the alert as urgent and BleepingComputer calls the flaw critical, while the published scores are in the high range.¹³

The vendor says it told customers with direct support contracts about the flaw and the fixes on 29 September, about two weeks before the public alert.¹ JPCERT/CC issued its own alert, JPCERT-AT-2026-0032, on 14 October, saying it has confirmed the product is widely used in Japan and urging users to consider both mitigation and an investigation for compromise.² BleepingComputer reported the exploitation on 18 October and notes that neither the vendor nor JPCERT/CC says who is behind the attacks, who the victims are, how widespread they are or what methods are used.³

BleepingComputer also repeats the vendor's claim that SiteGuard protects more than 1.5 million websites.³ The sources reviewed do not say when exploitation began.¹²³

Why it matters: the flaw sits in a security product that fronts web servers, exploitation is confirmed by the vendor, and because updating may erase traces of an attack, the vendor tells defenders to preserve diagnostics before they patch.¹²

Update, 22 October 2026: CISA added CVE-2026-106931 to its Known Exploited Vulnerabilities (KEV) catalogue on 20 October, listing it as an OS command injection flaw in EG Secure Solutions SiteGuard Server Edition and citing evidence of active exploitation.⁴ The Hacker News says federal civilian agencies must apply fixes by 23 October, and repeats the vendor's CVSS score of 8.5.⁵ It adds that no further details on the exploitation activity are available, so the questions the earlier reports left open, such as who is behind the attacks and who the victims are, remain unanswered in the sources reviewed.⁵

The catalogue addition came in the same batch as the four Plex2Shell flaws and a Siemens Software Center flaw.⁴⁵