---
title: SiteGuard Server Edition WAF CVE-2026-106931: exploited OS command injection gives root/SYSTEM; save diagnostics before patching | ctxsec
url: https://ctxsec.com/items/siteguard-cve-2026-106931
description: ""
status: "exploited (vendor advisory + JVN); on CISA KEV Oct 20 (due Oct 23), last updated Oct 20, 2026, 3:55 PM ET"
published: 2026-10-14
updated: 2026-10-20T15:55:00-04:00
---

> 

[← Cybersecurity News](/news) · [markdown](/items/siteguard-cve-2026-106931.md)

exploited (vendor advisory + JVN); on CISA KEV Oct 20 (due Oct 23)

2026-10-14 · updated

Oct 20, 2026, 3:55 PM ET

### SiteGuard Server Edition WAF CVE-2026-106931: exploited OS command injection gives root/SYSTEM; save diagnostics before patching

EG Secure Solutions (Oct 14) disclosed an OS command injection (CWE-78) in the statistics feature of SiteGuard Server Edition, the host-based WAF widely used in Japan, and says it is already being exploited. Affects Ver2.20 and later with statistics enabled (the default); IIS Ver3.10 to Ver4.00 Update4 are not affected. Successful exploitation runs arbitrary OS commands as root or SYSTEM. It is rated CVSS 4.0 8.5 / 3.0 7.8 with a local vector and low privileges required, so it is a privilege-escalation step on a server an attacker already has a foothold on, not unauthenticated remote code execution. Fixed in Apache/Nginx/IIS Ver8.00 Update5 (non-FreeBSD) and FreeBSD Apache/Nginx Ver7.00 Update6; a replacement patch for the statistics files is offered for versions that can't be upgraded, including end-of-support ones. Support customers were notified Sept 29, and JPCERT/CC issued an alert (JPCERT-AT-2026-0032). **Update (Oct 20):** CISA [added](https://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog) CVE-2026-106931 to KEV on Oct 20 with a federal due date of Oct 23 and its forensic-triage flag set, so collect evidence from affected servers before patching.

Sources: [EG Secure Solutions alert](https://eg-secure.co.jp/siteguard/news/alert-202610-1) · [JVN#88474777](https://jvn.jp/jp/JVN88474777/) · [CISA adds six KEVs (Oct 20)](https://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog)