EG Secure Solutions (Oct 14) disclosed an OS command injection (CWE-78) in the statistics feature of SiteGuard Server Edition, the host-based WAF widely used in Japan, and says it is already being exploited. Affects Ver2.20 and later with statistics enabled (the default); IIS Ver3.10 to Ver4.00 Update4 are not affected. Successful exploitation runs arbitrary OS commands as root or SYSTEM. It is rated CVSS 4.0 8.5 / 3.0 7.8 with a local vector and low privileges required, so it is a privilege-escalation step on a server an attacker already has a foothold on, not unauthenticated remote code execution. Fixed in Apache/Nginx/IIS Ver8.00 Update5 (non-FreeBSD) and FreeBSD Apache/Nginx Ver7.00 Update6; a replacement patch for the statistics files is offered for versions that can't be upgraded, including end-of-support ones. Support customers were notified Sept 29, and JPCERT/CC issued an alert (JPCERT-AT-2026-0032). Update (Oct 20): CISA added CVE-2026-106931 to KEV on Oct 20 with a federal due date of Oct 23 and its forensic-triage flag set, so collect evidence from affected servers before patching.