CVE-2026-106931: SiteGuard WAF OS Command Injection

CVE-2026-106931 is an OS command injection flaw in the default-enabled statistics feature of EG Secure Solutions' SiteGuard Server Edition, a Japanese host-based web application firewall, that lets a remote attacker run arbitrary OS commands with root or SYSTEM privileges on the protected server; CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-20 because it is already being exploited in the wild, and patching may erase forensic evidence of prior compromise.

CVE-2026-106931 is an OS command injection vulnerability (CWE-78) in SiteGuard Server Edition, a web application firewall from Tokyo-based EG Secure Solutions that installs directly on the server it protects (for Apache httpd, Nginx, IIS, and FreeBSD builds of Apache httpd/Nginx). NVD's record, now status "Analyzed", describes it as letting an attacker "execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product" (NVD).

NVD's analyzed record carries the JPCERT/CC-submitted scores: CVSS v3.0 7.8 (high), vector CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, and CVSS v4.0 8.5 (high), vector CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (NVD; JVN Advisory JVN#88474777).

CISA added CVE-2026-106931 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-20 with a required-action due date of 2026-10-23, confirming it is being exploited in the wild (CISA KEV).

The vendor's advisory states the flaw affects the default-enabled statistics feature and lists fixed versions: 8.00 Update 5 for the Apache httpd, Nginx, and IIS editions, and 7.00 Update 6 for the FreeBSD Apache httpd/Nginx editions. EG Secure Solutions and JPCERT/CC both warn that applying the patch can overwrite forensic traces of a prior intrusion, so administrators who suspect compromise are advised to preserve logs before updating; disabling the statistics feature is listed as an interim workaround (EG Secure Solutions advisory; JVN Advisory JVN#88474777).

As of 2026-10-21, FIRST scores the probability of exploitation at 0.0137 (71.6th percentile) (FIRST EPSS).

Because this is a KEV-listed, actively exploited flaw in internet-facing WAF software, any affected SiteGuard Server Edition deployment should be treated as a priority: preserve logs, then update to the fixed version or apply the vendor's standalone patch immediately.

• OS command injection (CWE-78) in the default-enabled statistics feature of SiteGuard Server Edition allows arbitrary OS command execution with root or SYSTEM privileges. — NVD
• NVD status is Analyzed; JPCERT/CC-submitted CVSS v3.0 base score 7.8 (vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and CVSS v4.0 base score 8.5. — NVD
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-20, required action due 2026-10-23, confirmed exploited in the wild. — CISA KEV
• Affects SiteGuard Server Edition for Apache httpd/Nginx/IIS versions 2.20 through pre-8.00 Update 5, and FreeBSD builds 2.20 through pre-7.00 Update 6; fixed in 8.00 Update 5 (7.00 Update 6 on FreeBSD); patching may erase forensic evidence, disabling the statistics feature is an interim workaround. — EG Secure Solutions advisory
• EPSS score is 0.01367 (71.6th percentile) as of 2026-10-21. — FIRST EPSS