CVE-2026-106931: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability

According to BleepingComputer, the flaw is tracked as CVE-2026-106931 and affects the statistics feature in host-based WAF instances, which is enabled by default.[1] SiteGuard's alert says "Abuse has already been confirmed,"[1] BleepingComputer reports.Cyber Security News reports that EG Secure Solutions confirmed exploitation and notified customers with direct support contracts on September 29, 2026.[2] The outlet adds that Japan's vulnerability coordination service published its JVN advisory on October 14, while JPCERT/CC also issued an alert.[2]Cyber Kendra reports that the flaw carries a CVSS v4 score of 8.5 (7.8 under CVSS v3)[3]. According to Cyber Kendra, an attacker therefore needs some existing access to the server first, then uses the flaw to turn that limited foothold into full control[3].SC Media reports that affected releases include versions 2.20 and later for Apache httpd, Nginx, and IIS (excluding FreeBSD) before 8.00 Update 5, and for Apache httpd and Nginx on FreeBSD before 7.00 Update 6.[4] Cyber Security News says IIS editions from version 3.10 through version 4.00 Update 4 are not affected.[2]Cyber Kendra reports that neither EG Secure Solutions nor JPCERT/CC has named the attackers, said how many customers were compromised, or explained how the initial access was obtained.[3]According to SC Media, SiteGuard advises administrators to preserve diagnostic information before applying updates or patches, as remediation may erase evidence of the attack.[4] Runtime Wire says JPCERT/CC advises disabling statistics as a workaround[5], but The Layman Security says the advisories do not list switching it off as an official workaround[6].