SiteGuard Warns Patching Actively Exploited Security Flaw Could Erase Evidence of Attacks

EG Secure Solutions has warned that a flaw in SiteGuard Server Edition is being exploited and that applying a fix could remove signs of an earlier attack.

The issue, CVE-2026-106931, affects the product’s statistics feature, which is enabled by default. Before updating, administrators should save diagnostic information so they can check whether the server was already compromised.

SiteGuard Server Edition is a host-based web application firewall (WAF) that runs on the web server it protects. The vulnerability is an operating system (OS) command injection flaw in the statistics function.

If exploited, it may let an attacker run commands with root privileges on Linux or FreeBSD systems, or SYSTEM privileges on Windows. The flaw is rated 8.5 under CVSS 4.0 and 7.8 under CVSS 3.0.

Researchers at Japan Vulnerability Notes (JVN) noted that the flaw had been exploited in the wild. JVN’s advisory does not name a malware family, attacker, victim, or specific method used in those attacks, and it does not publish hashes or other technical indicators.

The confirmed exploitation makes it important for organizations to investigate affected systems, rather than treating a successful update as proof that no intrusion occurred.

The risk applies to SiteGuard Server Edition version 2.20 and later when statistics is enabled, subject to specific exceptions. For Apache httpd, Nginx, and IIS, versions before 8.00 Update 5 are affected.

For Apache httpd and Nginx on FreeBSD, versions before 7.00 Update 6 are affected. IIS versions 3.10 through 4.00 Update 4 are not affected. Administrators should confirm their exact product, platform, version, and statistics setting against the JVN security advisory.

SiteGuard Warns Patching Actively Exploited Security Flaw

Command injection happens when software handles input in a way that allows it to be treated as a system command. In this case, the affected code sits in SiteGuard’s statistics processing—not in the WAF’s ordinary traffic-filtering rules.

Because SiteGuard runs on the server itself, successful exploitation could reach beyond the WAF and give an attacker control over the host.

That could expose data, allow changes to files or settings, or disrupt services. JVN describes the required access as local, with low privileges; this is not described as an unauthenticated remote flaw.

The issue also shows why WAFs should not be treated as a complete defense for the systems they protect. Security teams should keep the WAF and its host up to date, restrict administrative access, and watch for unusual activity on the server.

GBHackers has also covered web application firewall weaknesses and WAF security filter bypasses, illustrating that these products themselves need careful patching and monitoring.

Save evidence before patching

EG Secure Solutions warns that updating to a fixed version may erase traces of an attack. JPCERT/CC recommends preserving the product’s diagnostic information before upgrading.

Administrators should use SiteGuard’s web management screen to download and store that information, then follow the vendor’s instructions for remediation.

Keep the file in a protected location and record when and where it was collected, so investigators can use it during a later review.

This step matters because patching changes the affected software. If suspicious activity is discovered afterward, missing diagnostic data may make it harder to establish what happened before the update.

Organizations with signs of compromise should preserve relevant system and security logs and follow their incident-response process before making changes that could affect evidence.

The available advisory does not say that every update will erase evidence, but it clearly warns that traces may be removed. The recommended fix is to upgrade to the fixed release: version 8.00 Update 5 for Apache httpd, Nginx, and IIS, or version 7.00 Update 6 for Apache httpd and Nginx on FreeBSD.

The vendor also provides a patch that replaces files used for statistics processing, including for some end-of-life versions. JPCERT/CC says disabling the statistics feature can also avoid exposure; administrators should confirm the steps with EG Secure Solutions before relying on that workaround.

The disclosure timeline adds context. EG Secure Solutions says it notified customers with direct support contracts on September 29, 2026.

The public JVN advisory followed on October 14. JVN says the developer reported the vulnerability to Japan’s IPA, with JPCERT/CC coordinating disclosure.

The vendor has confirmed exploitation, but the published advisories do not give a count of affected systems or describe the attacks in detail.

For defenders, the practical order is clear: identify SiteGuard installations and versions, preserve diagnostic information, investigate for signs of compromise, and then apply the vendor’s fix or an approved workaround.

After remediation, continue monitoring the host and review available records for unexpected command execution or other unusual activity. A patched system is essential, but it does not replace an investigation into what may have happened before patching.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team