SiteGuard WAF Flaw CVE-2026-106931 Is Exploited, and Patching Can Erase the Evidence

Attackers are exploiting CVE-2026-106931, an OS command injection in EG Secure Solutions' SiteGuard Server Edition web application firewall, and CISA added it to its Known Exploited Vulnerabilities catalog on Oct. 20 with an Oct. 23 federal due date. A successful attack runs commands as root on Linux and FreeBSD or SYSTEM on Windows, and it requires the product's statistics function, which is on by default.

The vendor's own instruction is unusual: download the diagnostic bundle before you patch, because updating can remove evidence of an attack.

Affected versions and fixes

Platform	Vulnerable	Fixed in
Apache httpd, Nginx, IIS (not FreeBSD)	2.20 to before 8.00 Update 5	8.00 Update 5
Apache httpd, Nginx on FreeBSD	2.20 to before 7.00 Update 6	7.00 Update 6
IIS 3.10 through 4.00 Update 4	Not affected	None needed

For installations that cannot be upgraded, including end-of-life versions, the developer provides a patch that replaces the files used in statistical processing, according to JPCERT/CC's advisory JVN88474777. JPCERT/CC lists no separate workaround, though it says disabling the statistics function prevents exposure.

The score and the vector

The score understates the way this has been used. JPCERT/CC and the NVD record give 8.5 on CVSS 4.0 (AV:L/AC:L/PR:L/UI:N) and 7.8 on CVSS 3.0, both High, because the vector is local and needs low privileges. The vendor bulletin and JPCERT/CC nonetheless label the issue critical, and the vendor says "Abuse has already been confirmed," per BleepingComputer.

Those facts sit together uneasily. A local vector means the attacker must already be able to run something on the host or reach the statistics feature through another path, and none of the public advisories describe that path. The attackers and victims are not identified either. The score therefore says little about how exposed an internet-facing deployment is.

Timeline

The vendor notified customers with direct support contracts on Sept. 29, 2026. JPCERT/CC published JVN88474777 and the CVE record appeared on Oct. 14. BleepingComputer's Bill Toulas reported the exploitation on Oct. 18, and CISA's listing followed on Oct. 20. The vendor reported the flaw to Japan's Information-technology Promotion Agency (IPA), and JPCERT/CC coordinated.

That leaves 15 days between the vendor's private notice and the public advisory, during which only contract customers were told. As with Nextcloud's Collabora server, exploitation preceded a broad public warning.

What to do, in order

First, in the web management screen, choose Diagnostic information, then Download diagnostic information, and store the bundle off the affected server. Second, update to 8.00 Update 5 or 7.00 Update 6, or apply the standalone patch. JPCERT/CC recommends a compromise investigation on affected systems, since exploitation has been observed.

Operators who cannot patch the same day can disable the statistics function. Federal agencies had until Oct. 23 under the catalog's rules; for everyone else, CISA's other October listings such as Plex2Shell show deadlines that run as short as three days.