CVE-2026-106931
OS command injection in SiteGuard WAF lets attacker execute commands with root or SYSTEM privileges
An OS command injection flaw in the statistics function of SiteGuard Server Edition, a web application firewall widely used in Japan, allows attackers to execute arbitrary commands with root or SYSTEM privileges. The vulnerability is being actively exploited, and CISA has added it to its Known Exploited Vulnerabilities catalog. Fixed versions are available.
EG Secure Solutions SiteGuard Server Edition · Updated 28 Oct · From 1 of our story and the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 20 Oct; US agencies must fix by 23 Oct
SeverityhighCVSS 8.5 of 10
FixAvailableFixed versions below
Am I affected?
If you run a version older than the fixed one for your line, yes.
| Version line | Fixed in |
|---|---|
| SiteGuard Server Edition for Apache httpd Ver8.00 Update 5 | Ver8.00 Update 5 |
| SiteGuard Server Edition for Nginx Ver8.00 Update 5 | Ver8.00 Update 5 |
| SiteGuard Server Edition for IIS Ver8.00 Update 5 | Ver8.00 Update 5 |
| SiteGuard Server Edition for Apache httpd on FreeBSD Ver7.00 Update 6 | Ver7.00 Update 6 |
What to do
- Check your SiteGuard Server Edition version against the fixed versions: for Apache httpd, Nginx, and IIS use Ver8.00 Update 5; for FreeBSD use Ver7.00 Update 6.
- If your version is below the fixed version, update immediately to the appropriate fixed version.
- US federal agencies must apply the fix by 2026-10-23 per the CISA directive.
What happened
- 18 OctSecurity researchers report active exploitation of the SiteGuard WAF OS command injection vulnerability.
- 20 OctCISA adds CVE-2026-106931 to its Known Exploited Vulnerabilities catalog.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-106931 | EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability | high 8.5 | 20 Oct | 2.5% |
Our reporting
18 OctHackers exploit critical SiteGuard WAF flaw to gain root, SYSTEM accessReported elsewhere
CISA · 20 OctCISA Adds Six Known Exploited Vulnerabilities to Catalog ↗The records
CISA known-exploited catalog ↗CVE-2026-106931 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works