CVE-2026-106931: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability

SiteGuard's alert, quoted by BleepingComputer, says the flaw "has been found in the statistics function of SiteGuard Server Edition"[1] and that "abuse has already been confirmed."[1]According to Security Affairs, SiteGuard is a Japanese web application firewall (WAF) that runs directly on the web server it protects[2]. Cyber Kendra reports that the statistics feature ships enabled by default[3].Security Affairs says the vendor and JVN rated the vulnerability with a CVSS 4.0 score of 8.5 and a CVSS 3.0 score of 7.8[2]. It also notes that an attacker needs local access and low-level privileges to exploit this vulnerability.[2]The vendor told BleepingComputer that affected versions include Apache httpd, Nginx, and IIS (excluding FreeBSD) versions 2.20 and later, before 8.00 Update 5[1], as well as Apache httpd and Nginx on FreeBSD versions 2.20 and later, before 7.00 Update 6.[1] JPCERT/CC notes that IIS editions 3.10 through 4.00 Update 4, inclusive, are not affected[1].According to Security Affairs, the vendor's advisory tells customers to "download and save your "Diagnostic Information" (as this may erase traces of the attack)"[2] before they update.eSecurity Planet reports that customers with direct support contracts were notified about the vulnerability and countermeasures on Sept. 29, while the public advisory arrived Oct. 14.[4] The outlet adds that the vendor hasn't disclosed when exploitation began, who is behind it, or how many systems have been compromised.[4]