JVN88474777

jvn.jp • October 15, 2026

SiteGuard Server Edition provided by EG Secure Solutions Inc. contains an OS command injection vulnerability.

SiteGuard Server Edition Ver2.20 and later versions For IIS: versions from Ver3.10 to Ver4.00 Update 4 are not affected. The product is affected by this vulnerability when the statistics feature is enabled. The feature is enabled by default.

SiteGuard Server Edition Ver2.20 and later versions For IIS: versions from Ver3.10 to Ver4.00 Update 4 are not affected.

For IIS: versions from Ver3.10 to Ver4.00 Update 4 are not affected.

SiteGuard Server Edition provided by EG Secure Solutions Inc. is a host-based Web Application Firewall (WAF) designed to be integrated into a web server. The statistics feature of SiteGuard Server Edition contains the following vulnerability: OS command injection ( CWE-78 ) CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Base Score 7.8 CVE-2026-106931 Note that the vulnerability has been confirmed to be exploited in the wild.

OS command injection ( CWE-78 ) CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Base Score 7.8 CVE-2026-106931

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.5

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Base Score 7.8

An attacker may be able to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

Update the Software Update the software to the latest version according to the information provided by the developer. This vulnerability has been fixed in the following versions: For Apache httpd, Nginx, IIS: Ver8.00 Update 5 For Apache httpd and Nginx on FreeBSD: Ver7.00 Update 6 Apply the patch For users who are unable to upgrade, the developer provides a patch that replaces the files used in statistical processing. The patch is available even for end-of-life (EOL) versions. The developer notified customers with direct support contracts of this vulnerability and the available countermeasures on September 29, 2026. For more details, refer to the information provided by the developer.

For Apache httpd, Nginx, IIS: Ver8.00 Update 5

For Apache httpd and Nginx on FreeBSD: Ver7.00 Update 6

Vulnerability Analysis by JPCERT/CC

The developer reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

JPCERT Alert JPCERT-AT-2026-0032 Security Advisory Regarding an OS Command Injection Vulnerability (CVE-2026-106931) in SiteGuard Server Edition (Text in Japanese) JPCERT Reports CERT Advisory CPNI Advisory TRnotes CVE CVE-2026-106931 JVN iPedia JVNDB-2026-000148

List of Vulnerability Report

List of unreachable developers

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OS Command Injection Flaw in SiteGuard WAF Exploited EG Secure Solutions disclosed that attackers are exploiting an OS command injection vulnerability in SiteGuard Server Edition, tracked as CVE-2026-106931. This flaw allows attackers to execute commands with root or SYSTEM privileges, affecting versions 2.20 and later, with the statistics feature enabled by default. The vulnerability has a CVSS v4 score of 8.5 and has been confirmed to be exploited in the wild. JPCERT/CC issued an emergency alert, noting the WAF's widespread deployment in Japan. Affected organizations are advised to apply patches or disable the statistics feature to mitigate risks. The vendor has provided a patch for supported versions and a workaround for end-of-life versions. Administrators are warned that patching may erase traces of an intrusion, and they should collect diagnostic data before applying fixes. 1 sources 72

Extracted Entities

JVN88474777

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (3)

Tools (1)

Vulnerabilities (1)