CVE-2026-106931

What is SiteGuard Server Edition?

SiteGuard Server Edition is a host-based web application firewall sold by EG Secure Solutions, a Japanese security vendor. Unlike a network appliance or a cloud WAF, it installs as a module on the web server itself: there are builds for Apache httpd, Nginx, and Microsoft IIS on Linux, Windows, and FreeBSD. It inspects requests in-process, applies signature and rule-based filtering, and ships with a web-based admin console for rules, logs, and reporting. It is widely deployed in Japan, particularly by hosting providers and by organisations that need WAF coverage without putting another box in front of their estate.

Running inside the web server makes it a high-value target for two reasons. First, the product and its helper processes run with elevated privileges, so a flaw in them escalates straight to root or SYSTEM. Second, a WAF sits on the exact hosts that already take untrusted traffic, so an attacker who has already landed a low-privileged foothold through a web application finds the WAF conveniently installed next to them.

Overview

CVE-2026-106931 is an OS command injection flaw in the statistics feature of SiteGuard Server Edition. The statistics feature is enabled by default, so almost every installation is exposed unless an administrator turned it off. An attacker who already holds low-privileged local access on the host can inject operating system commands through that feature and have them executed with root privileges on Unix-like builds or SYSTEM privileges on IIS builds.

The practical effect is a reliable local privilege escalation on the very host the product is meant to defend. That is a natural second stage after a web shell or a compromised service account: the attacker starts as the web server user and ends as root, with the ability to disable the WAF, tamper with its logs, and move on to whatever the host can reach.

EG Secure Solutions confirmed that exploitation had already occurred when it published the advisory on 2026-10-14, and JPCERT/CC issued alert JPCERT-AT-2026-0032 the same day urging immediate updates. Neither the vendor nor JPCERT/CC has published attack details, victim counts, or attribution. CISA added the CVE to the KEV catalog on 2026-10-20 with a three-day remediation deadline of 2026-10-23.

Scoring differs by version of the standard: JVN publishes CVSS v4.0 8.5 and CVSS v3.0 7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Both reflect the same picture, a locally exploitable flaw with total impact on the host.

Affected Versions

Only installations with the statistics feature enabled are exploitable, but that is the default state. For versions that are past end of life or that cannot be upgraded immediately, the vendor supplies a patch that replaces the files used in statistical processing.

Technical Details

The vulnerability is classified as CWE-78, improper neutralisation of special elements used in an OS command. In plain words, the statistics feature builds a shell command from input it does not properly sanitise, so characters that a shell treats as syntax rather than data (separators, pipes, backticks) survive into the command line and let an attacker append commands of their own choosing. The injected commands inherit the privilege level of the component that runs them, which is root on the Unix builds and SYSTEM on IIS.

Attack characteristics: the attack vector is local, not network, so an attacker needs code execution or a shell on the host first. Low privileges are sufficient, no user interaction is required, and attack complexity is low. There is no scope change in CVSS terms because the attacker stays on the same host, but the result is full administrative control of it. The vendor has not published the vulnerable parameter or a proof-of-concept, and no public exploit code has been identified at the time of writing.

Discovery

EG Secure Solutions identified the flaw itself and reported it to IPA, Japan's Information-technology Promotion Agency. JPCERT/CC coordinated publication with the developer under the Information Security Early Warning Partnership, which is the standard Japanese coordinated disclosure process, and the advisory was published as JVN#88474777 and JVNDB-2026-000148. No external researcher is credited. The vendor notified customers with direct support contracts on 2026-09-29, roughly two weeks before the public advisory.

Exploitation Context

Exploitation is confirmed by both the vendor and JPCERT/CC, which is unusual candour for a Japanese advisory and is the basis for the KEV listing. What is not available is detail: no threat actor has been named, no indicators of compromise have been released, no victim or exposure counts have been published, and no ransomware use has been reported.

The attack prerequisite of local access means this is almost certainly being used as a post-exploitation step rather than as an initial access vector. The likely chain is a separate web application compromise that yields the web server account, followed by CVE-2026-106931 to reach root. Because the statistics feature is on by default and the product is installed on internet-facing web servers by design, the population of usable targets is effectively the whole installed base. Note that the vendor explicitly warns that applying the update can erase forensic traces of an attack, which implies that at least some compromised hosts were found only after the fact.

Remediation

1. Update to the fixed release for your build: Ver8.00 Update5 for Apache httpd, Nginx, and IIS, or Ver7.00 Update6 for Apache httpd and Nginx on FreeBSD.
2. Before applying the update, save the diagnostic information from the web admin console and copy it off the host. The vendor warns that updating may destroy evidence of an attack, so collect it first.
3. If you cannot upgrade, including on end-of-life versions, request and apply the vendor patch that replaces the statistical processing files. Disabling the statistics feature removes the exposed code path and is a reasonable stopgap where the patch cannot be applied immediately.
4. Treat any host that ran a vulnerable version as potentially compromised rather than assuming the update is sufficient. Patching does not remove an attacker who already reached root.
5. Review logs for the period before patching: web server access and error logs for the initial foothold, SiteGuard logs for gaps or tampering, authentication and sudo logs, and any newly created accounts, SUID binaries, cron entries, or scheduled tasks.
6. Restrict access to the SiteGuard admin console to a management network, and verify that the web server account cannot write to directories used by the product.
7. Federal civilian agencies must remediate by 2026-10-23 under BOD 22-01. Given confirmed exploitation and a three-day deadline, treat this as an emergency change in any environment.