SiteGuard Server Edition: command injection exploited for root

On 14 October 2026 JPCERT/CC and IPA published advisory JVN#88474777 on the JVN portal, covering SiteGuard Server Edition, the web application firewall (WAF) from EG Secure Solutions Inc. that is installed directly on the web server it protects. The vulnerability, CVE-2026-106931, is an OS command injection (CWE-78) in the statistics feature, which is enabled by default, and allows operating system commands to be executed with root or SYSTEM privileges.

The JVN advisory states that exploitation has already been confirmed. The vendor’s bulletin, quoted by BleepingComputer and Security Affairs, says the same. JPCERT/CC also issued an alert in Japanese (JPCERT-AT-2026-0032); the JVN iPedia entry is JVNDB-2026-000148.

Technical details

• Product: SiteGuard Server Edition, a host-based WAF integrated into the web server, in its editions for Apache httpd, Nginx and IIS.
• Component: the statistics feature. The product is only vulnerable when the feature is enabled, but it is enabled by default.
• Type: OS command injection (CWE-78).
• Scores: CVSS 4.0 8.5 (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) and CVSS 3.0 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). JVN and the vendor nonetheless rate the vulnerability as critical, even though the base scores correspond to high severity.
• Impact: execution of arbitrary commands as root (Linux, FreeBSD) or SYSTEM (Windows) on the machine hosting the WAF.

The vector is local and requires low privileges: the attacker must already be able to act on the system with an unprivileged account. Security Affairs infers that the flaw is probably used after an initial foothold, to take full control of the server. In MITRE ATT&CK terms, exploitation falls under T1068 (Exploitation for Privilege Escalation).

As both outlets note, it is still unknown who the attackers are, who the victims are, how many systems have been hit and how the attacks are carried out: neither JVN nor the vendor says, and there are no public indicators of compromise.

Affected and fixed versions

Versions 2.20 and later are affected:

• editions for Apache httpd, Nginx and IIS (excluding FreeBSD): up to, but not including, 8.00 Update 5;
• editions for Apache httpd and Nginx on FreeBSD: up to, but not including, 7.00 Update 6.

Editions for IIS from 3.10 to 4.00 Update 4 inclusive are not affected.

The fixed versions are 8.00 Update 5 (Apache httpd, Nginx, IIS) and 7.00 Update 6 (Apache httpd and Nginx on FreeBSD). For those who cannot upgrade, the vendor provides a patch that replaces the files used in statistics processing, available for end-of-life versions too.

A two-stage timeline

The vendor reported the vulnerability to IPA, and JPCERT/CC coordinated the disclosure. Customers with a direct support contract were notified on 29 September 2026; the public bulletin and the JVN advisory came out on 14 October. As Security Affairs points out, customers without direct support therefore received the warning about two weeks later. The sources do not say since when the vulnerability has been exploited.

According to BleepingComputer, SiteGuard is one of the leading Japanese WAF vendors and claims to protect more than 1.5 million websites; the sources give no figures on how widespread the Server Edition is outside Japan.

Impact for European and Italian companies

SiteGuard is a Japanese product and the sources do not say how widely it is used in Europe. It may still be found on servers of Japanese subsidiaries of European groups, or on sites run by suppliers that use it: it is worth checking, including with the providers that host your websites.

The case is sensitive because the vulnerable component is the very one meant to protect the web server: whoever gains root or SYSTEM on the WAF machine can read certificates and credentials, alter the published applications and switch off the protection itself. For NIS2 entities, the response falls within vulnerability and supply chain management; a confirmed compromise must be assessed for notification to the national CSIRT (in Italy, CSIRT Italia at ACN).

What to do now

1. Take inventory: look for SiteGuard Server Edition on every web server, including those managed by suppliers, and record version, platform and the status of the statistics feature.
2. Preserve evidence before acting. The vendor warns that updating or patching may erase traces of the attack: from the web management screen, download and keep the “Diagnostic information” (Diagnostic information → Download diagnostic information). A clean server after the update does not prove it was clean before.
3. Update to 8.00 Update 5 or, on FreeBSD, to 7.00 Update 6; if you cannot, apply the statistics file patch, including on end-of-life versions.
4. Look for signs of compromise: unusual child processes started with elevated privileges by WAF components, new accounts or SSH keys, scheduled tasks, changes to web application files, unexpected outbound connections from the server.
5. Look for the initial access: since the flaw requires a local account, also check how an attacker might have obtained one (weak or reused credentials, other vulnerable applications on the same server).
6. If you find a compromise, treat the machine as untrustworthy: rebuild it, change credentials and renew the certificates it hosted.

How ARXDOME helps

The ARX Sentry agent collects the software inventory of computers and servers, useful for quickly finding SiteGuard installations and their versions, together with logs, security events and file integrity monitoring in the chosen folders, which flags unexpected changes. ARX Shield shows open vulnerabilities by machine and by package, with those already exploited highlighted. With ARX Trace, analysts can launch evidence collections on multiple machines before the update, so the traces remain available for the investigation.

Last updated: 19 October 2026