Japan’s SiteGuard WAF flaw CVE-2026-106931 is already being exploited

Attackers are exploiting vulnerability CVE-2026-106931 in SiteGuard Server Edition to run commands as root or SYSTEM.

EG Secure Solutions published an urgent alert warning of CVE-2026-106931, an OS command injection bug in SiteGuard Server Edition. Threat actors are already exploiting it in the wild. A successful exploit lets them run commands with root or SYSTEM privileges on the server where the product runs.

SiteGuard is a Japanese web application firewall (WAF) that runs directly on the web server it protects. The vulnerability affects its statistics feature, which is enabled by default.

The vendor and JVN rated the vulnerability with a CVSS 4.0 score of 8.5 and a CVSS 3.0 score of 7.8. An attacker needs local access and low-level privileges to exploit this vulnerability. This suggests the flaw may be used after an attacker has already gained access to a system.

The vulnerability impacts version 2.20 or later. On Apache, Nginx and IIS that means anything before 8.00 Update 5, except FreeBSD, and on FreeBSD with Apache or Nginx it means anything before 7.00 Update 6. IIS editions from 3.10 through 4.00 Update 4 aren’t affected, and only installs with the statistics function enabled are exposed.

For people who can’t upgrade their version, the vendor offers a patch that replaces the files used in statistics processing, and it covers end-of-life versions too.

Be aware that updating or patching can erase the traces of an attack, so the vendor tells administrators to download the diagnostic information first.

“Before updating, please be sure to download and save your “Diagnostic Information” (as this may erase traces of the attack).” reads the vendor’s advisory.

In the web management screen that’s the diagnostic information page, then the download option. Do it before you touch anything, because a clean server after the update doesn’t prove it was clean before.

The timeline is short, but not everyone was warned at the same time. The vendor says it notified customers with direct support contracts on September 29. The public alert and the JVN advisory were published on October 14. The vendor reported the vulnerability to Japan’s IPA, while JPCERT/CC coordinated the disclosure and published its own alert. Customers without direct support contracts received the warning about two weeks later.

Many details remain unknown. Neither advisory identifies the attackers or victims, explains how the attacks were carried out, or says how many systems were affected. The vendor has confirmed that the vulnerability has been exploited. If you use this product, check your systems for signs of compromise and investigate any suspicious activity.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, SiteGuard WAF)