SiteGuard Server Edition flaw exploited in the wild (CVE-2026-106931): who is affected, fixed versions, preserving evidence before you update, and checking for compromise

Key points for company leaders

This article reflects information available on the evening of 22 October 2026 (Japan time). For the latest, check the sources at the end, above all EG Secure Solutions' notice.

• What happened

  On 14 October EG Secure Solutions disclosed an OS command injection vulnerability, CVE-2026-106931, in the statistics feature of SiteGuard Server Edition, its host-based WAF. If exploited, arbitrary OS commands may run as root or SYSTEM on the server running the product. The company says it has confirmed exploitation.^[1][2][3]

• Who is affected

  Version 2.20 and later with the statistics feature enabled, which is the default. For the Apache, Nginx and IIS editions, versions before Ver8.00 Update5 are affected; for the FreeBSD Apache and Nginx editions, versions before Ver7.00 Update6. JPCERT/CC says the product is widely used in Japan.^[1][3]

• Exploitation

  Besides the vendor confirming exploitation, the US CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on 20 October (US time). The deadline for US federal agencies is 23 October. Use in ransomware campaigns is listed as unknown.^[1][4][5]

• What to do today

  Check whether SiteGuard Server Edition runs on servers operated by you, your contractors or your hosting provider. If it does, first download and keep the diagnostic data from the web admin screen, then update to a fixed version or apply the patch, and investigate for compromise. Updating or patching may erase traces of an attack.^[1][3]

What to do today: five steps

We have put the guidance from the vendor and JPCERT/CC into a practical order. Your IT staff or contractors do the technical work, but leaders can check that each step is done.^[1][3]

1. 01Inventory: list every web server running SiteGuard Server Edition, including those run by contractors and hosting providers, and record the edition (Apache, Nginx, IIS or FreeBSD) and version.^[1]
2. 02Preserve evidence: before updating or patching, go to [Diagnostic information] → [Download diagnostic information] in the web admin screen, and store the file off the server.^[1][3]
3. 03Fix: update the Apache, Nginx and IIS editions to Ver8.00 Update5, and the FreeBSD Apache and Nginx editions to Ver7.00 Update6. If you cannot upgrade, apply the patch that replaces the statistics-processing files; it is also available for end-of-life versions.^[1]
4. 04If you cannot fix it yet: JPCERT/CC says disabling the statistics feature avoids the flaw. Check the vendor's latest information for how to disable it.^[3]
5. 05Check for compromise: JPCERT/CC asks users to consider a compromise investigation alongside the fix. Use the saved diagnostic data and server logs to look for anything suspicious (see below).^[3]

What the flaw is

SiteGuard Server Edition is a host-based WAF (web application firewall) installed into the web server itself. It runs as a web server module and protects sites from attacks such as SQL injection. It has statistics and reporting features that tally detected attacks and show them as charts, and this flaw is in the statistics feature.^[2][6][1]

• Type: OS command injection (CWE-78). The CVE is CVE-2026-106931 and the JVN ID is JVN#88474777.^[1][2]
• Impact: arbitrary OS commands may run as root or SYSTEM on the server running the product, meaning an attacker could gain the highest level of control over that server.^[1][3]
• Severity: 8.5 on CVSS v4.0 and 7.8 on CVSS v3.0. The vendor and JVN label it urgent in their titles; NVD rates it HIGH.^[1][2][7]

Who is affected

Affected are SiteGuard Server Edition Ver2.20 and later, before the fixed versions below. The IIS edition from Ver3.10 to Ver4.00 Update4 is not affected. The flaw only applies when the statistics feature is enabled, and it is enabled by default.^[1][3][2]

Ver2.20, where the affected range starts, was released on 30 April 2015, so servers that have run the product for more than ten years can be in scope.^[8]

• Even if you did not install it yourself, it may be in use on a rental server, cloud or managed dedicated server service. The vendor's operating-environment page lists commonly used services such as Amazon EC2, Sakura VPS and Sakura Cloud, and several providers' managed dedicated servers and hosting services. Ask each provider whether they install and update it for you.^[9]
• The SiteGuard family also includes the gateway-type Proxy Edition and the cloud-based Cloud Edition. The disclosure names only Server Edition as affected.^[1][6]

How to check whether you are affected

If you do not know which version you run, check it as the product manual describes, or ask the vendor's support desk. According to the vendor, the support contact is listed in the contract confirmation document supplied at delivery, or you can ask the reseller you bought from. The latest software and manuals are on the user download page, which requires a login.^[1][10]

How to update or patch

• Follow the detailed update steps in the information the vendor provides to users (version-up notes and manuals). The vendor says it notified customers with direct support contracts individually on 29 September.^[1][10]
• If you bought it through a reseller or use it through a hosting provider, confirm whether they have already applied the fix. The vendor says resellers can tell you which support desk to contact.^[1]
• If you can neither update nor patch right away, JPCERT/CC lists disabling the statistics feature as a workaround. You lose the statistics and reports, so treat it as a stopgap until the fix is in. Check the vendor's latest information for the steps.^[3]

Looking for signs of compromise

When we checked, neither the vendor nor JPCERT/CC had published a specific list of indicators of compromise (IoCs). The vendor asks users to preserve evidence by saving the diagnostic data, and JPCERT/CC asks them to consider a compromise investigation. In KEV, CISA requires US federal agencies to carry out forensic triage for this flaw, and its steps are a useful reference for Japanese organisations too.^{[1][3][4][11]}

• Scope

  Identify the affected servers and the systems and services connected to them. Set up a way to communicate that does not rely on possibly compromised infrastructure.^[11]

• Collect evidence first

  Where possible, collect evidence before you fix or change anything. Prioritise data that is lost at power-off, such as memory, and log what you collected, when and from which server. Save SiteGuard's diagnostic data at this stage too.^[11][1]

• Contain

  Once evidence is collected, isolate the affected servers. Containing too early can destroy evidence, and it should be done without alerting the attacker.^[11]

• What to look for

  Look for unauthorised access to systems, accounts or data, signs of the attacker's presence, lateral movement, persistence mechanisms, and data staging or exfiltration, and check whether any indicators you find appear elsewhere.^[11]

If you suspect or confirm a compromise

1. 01Preserve evidence, then isolate the server. CISA stresses coordinating evidence collection with containment.^[11]
2. 02Contact the vendor's support desk and JPCERT/CC. JPCERT/CC asks anyone with information on this issue to get in touch.^[1][3]
3. 03Because the flaw can lead to commands running as root or SYSTEM, treat a compromised server as fully in the attacker's hands: consider rotating passwords, API keys and other secrets stored on it, and rebuilding it. Apply the fix before you bring it back.^[1]
4. 04Look for other ways in. CVSS says an attack needs low privileges on the server, so check whether another entry point, such as a web application, was used.^[7][11]
5. 05If personal data may have leaked, you may have legal duties to report it and notify the people affected. Check with an expert.

Timeline

The developer reported the flaw to IPA under the Information Security Early Warning Partnership, and JPCERT/CC coordinated with the developer.^[2]

Preventing a repeat

• Track support dates: the vendor ends support for older versions as new ones ship, and part of the Ver7.00 line reaches end of support on 30 November 2026. Keep a register of the versions you run and their end dates.^[8]
• Make sure vendor notices reach you: the vendor sends version-up information to registered addresses. Check that the registered contact is not someone who has left or an old contractor address.^[12][1]
• Treat security products as software to patch: defensive products such as WAFs can have vulnerabilities too. As with the OS and applications, decide who owns their updates.^[1][2]
• Build a habit of checking public sources: JVN, JPCERT/CC alerts and CISA's KEV catalog are early signals of vulnerabilities under active exploitation.^[3][4]

FAQ

Printable checklist

• Checked for SiteGuard Server Edition on servers run by us, our contractors and our hosting providers
• Recorded the edition (Apache, Nginx, IIS or FreeBSD) and version of each
• Checked whether the statistics feature is enabled (it is by default)
• Downloaded the diagnostic data from the web admin screen before updating, and stored it off the server
• Updated to Ver8.00 Update5 (Ver7.00 Update6 on FreeBSD) or applied the patch
• Considered disabling the statistics feature where the fix cannot go in yet
• Investigated for compromise using the diagnostic data and logs
• Contacted the vendor's support desk, JPCERT/CC or specialists about anything suspicious
• Planned a move off unsupported versions (part of the Ver7.00 line ends on 30 November 2026)
• Confirmed the contact registered with the vendor is up to date

How ZeroKai can help

The first stumbling block with a vulnerability like this is not knowing what runs on which server. ZeroKai takes your domain, lists the host names recorded in Certificate Transparency logs and highlights names that look like admin screens or test environments. For domains whose ownership you have verified, it also shows exposed remote access, file sharing, database and FTP services observed by Shodan. The console also lets you browse vulnerability information from CISA's KEV catalog and JVN iPedia.