SiteGuard WAF flaw CVE-2026-106931 lets a low-privilege foothold run commands as root. It's exploited. Here's how to check client servers.
The software bolted onto a web server to keep attackers out is, right now, helping them take it over. A command injection bug in SiteGuard Server Edition, a web application firewall from Japan's EG Secure Solutions, lets anyone who already has a low-privilege login on the server run commands as root, and the vendor says it has already seen it abused.
Think of a nightclub bouncer who checks every ID at the door, but who also hands the master key to anyone who sneaks in through the kitchen.
CVE-2026-106931 is an OS command injection vulnerability (CWE-78) in the statistics function of SiteGuard Server Edition, which JVN describes as a host-based web application firewall (WAF) that runs inside the web server itself. A WAF is a filter that inspects web traffic and blocks attacks like SQL injection before they reach the app.
"Command injection" means the statistics code takes some input and passes it to the operating system's command line without cleaning it. Slip in the right characters and the system runs your command too, with the privileges of whatever runs the statistics job. Here that is root or SYSTEM.
The scores are CVSS 7.8 under version 3.0 and 8.5 under version 4.0. Both vectors say the attack is local and needs low privileges. In plain words: this bug doesn't break the front door. It turns a foothold into full control.
SiteGuard is big in Japan. By the company's own claim, according to BleepingComputer, it protects more than 1.5 million websites. The advisories name only Server Edition.
Yes. EG Secure Solutions wrote in its October 14 advisory that abuse has already been confirmed, and JPCERT/CC echoed it the same day. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 20, 2026, set a federal due date of October 23, 2026, and flagged it for forensic triage, not just patching.
The timeline matters for partners. The vendor quietly told customers with direct support contracts on September 29, 2026, two weeks before the public advisory. If a client bought SiteGuard through a reseller or a hosting bundle, they may have heard nothing until October.
Who is attacking, which victims, and how attackers got the first foothold are all unknown. eSecurity Planet notes that no advisory describes an unauthenticated remote exploit. That last gap is the important one: something else let the attacker onto the server first.
SiteGuard Server Edition 2.20 and later is affected when the statistics feature is enabled, which is the default:
Start by finding where SiteGuard runs, then look for signs someone used it. No indicators of compromise have been published, so these checks hunt for the generic marks of a root takeover.
D=/root/ir-$(hostname)-$(date +%Y%m%d); sudo mkdir -p "$D"
sudo cp -a /var/log/apache2 /var/log/httpd /var/log/nginx "$D"/ 2>/dev/null
sudo find "$D" -type f -exec sha256sum {} + | sudo tee "$D.sha256"
sudo apachectl -M 2>/dev/null | grep -i siteguard
sudo nginx -T 2>/dev/null | grep -i siteguard
sudo find / -iname '*siteguard*' -not -path '/proc/*' 2>/dev/null | head
To run only the filesystem search above across a Linux fleet listed in hosts.txt:
while read -r h; do echo "== $h"; ssh -n "$h" "sudo find / -iname '*siteguard*' -not -path '/proc/*' 2>/dev/null | head -5"; done < hosts.txt
Invoke-Command -ComputerName (Get-Content hosts.txt) { Get-WebGlobalModule | Where-Object Name -match 'siteguard' }
Read the version. The advisories publish no version command, so read it in the SiteGuard web management screen and compare it with the fixed releases above.
Look for root-owned children of the web server. This shows processes still running only:
ps -eo pid,ppid,user,comm,args --forest | grep -B2 -A6 -E 'apache2|httpd|nginx'
A root shell, curl, wget or nc under a worker is a red flag.
sudo ls -la /etc/cron* /var/spool/cron/*
sudo awk -F: '$3==0' /etc/passwd
sudo find /root/.ssh /home/*/.ssh -name authorized_keys -mtime -60 -ls
sudo find /var/www /srv -type f \( -name '*.php' -o -name '*.jsp' \) -mtime -60 -ls
CVE-2026-106931 is a second-stage bug, so the honest question for your clients is: what hands an attacker that first low-privilege foothold? That's what an autonomous pentest is built to answer.
KinoSec tests your clients' web apps, external networks and Active Directory the way an attacker would: reconnaissance, finding the file upload, injection or weak login that gives a first shell, then chaining it toward a full takeover. It writes that path up with remediation in a report you can hand your client. KinoSec doesn't replace the version check above. It shows which clients have an open kitchen door, so a bug like this never gets its chance.
CVE-2026-106931 is an OS command injection vulnerability in the statistics feature of SiteGuard Server Edition, a host-based web application firewall from EG Secure Solutions. An attacker with a low-privilege account on the server can run commands as root on Linux and FreeBSD or SYSTEM on Windows. It scores CVSS 7.8 under version 3.0 and 8.5 under version 4.0.
First, download SiteGuard's diagnostic information from Diagnostic information → Download diagnostic information in the web management screen. Second, look for root-owned children of the web server with ps -eo pid,ppid,user,comm,args --forest. Third, check persistence with sudo ls -la /etc/cron* /var/spool/cron/* and sudo awk -F: '$3==0' /etc/passwd.
Preserve evidence first, because the vendor warns that updating may erase attack traces. Then upgrade to 8.00 Update 5 for Apache, Nginx and IIS, or 7.00 Update 6 on FreeBSD. If you can't upgrade, request EG Secure Solutions' patch for the statistics files or turn the statistics feature off.
Not on its own, according to the published scores: both CVSS vectors say the attack is local and needs low privileges. No advisory describes an unauthenticated remote exploit, and how attackers got their first foothold has not been disclosed. That is why the fix list includes hunting for the foothold, not just patching.
KinoSec looks for the web app, network and Active Directory weaknesses that give an attacker the first foothold this bug needs, and chains them the way a real intruder would. It doesn't replace reading the SiteGuard version in the web management screen. Together, the two tell you whether a client could be taken over this way.