Threat reportVulnerabilityTL-2026-3854
SiteGuard Server Edition WAF OS command injection (CVE-2026-106931) actively exploited to run commands as SYSTEM/root
SiteGuard Server Edition WAF OS command injection (TL-2026-3854), also tracked as JVN#88474777, is a high-severity software vulnerability scored CVSS 7.8, first published 2026-10-18 and last reviewed 2026-10-19. It has no confirmed attribution, affects EG Secure Solutions Inc. SiteGuard Server Edition (Apache httpd, references 1 CVE (CVE-2026-106931), maps to 5 MITRE ATT&CK techniques (T1059.003, T1059.004, T1068), and is covered by 9 detection rules and 10 indicators of compromise.
- CVSS
- 7.8/10High
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-3854
- Threat ID
- TL-2026-3854
- Also known as
- JVN#88474777, JPCERT-AT-2026-0032
- Severity
- HIGH
- CVSS
- 7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, government administration, finance, retail, health
- Target regions
- japan
- Detection rules
- 9
- Indicators of compromise
- 10
- Updates
- 2026-10-19 · revalidated 1× · latest source
Malware and tooling in SiteGuard Server Edition WAF OS command injection
Malware and tooling: IPA, root, SiteGuard Server Edition
How SiteGuard Server Edition WAF OS command injection works
An OS command injection flaw (CWE-78) in the statistics feature, enabled by default, of EG Secure Solutions' SiteGuard Server Edition host-based WAF is exploited in the wild and allows arbitrary OS command execution as root or SYSTEM. Fixed in Ver8.00 Update 5 (Apache httpd/Nginx/IIS) and Ver7.00 Update 6 (FreeBSD).
CVE-2026-106931 is an OS command injection vulnerability (CWE-78) in the statistics processing feature of SiteGuard Server Edition, a host-based web application firewall from EG Secure Solutions Inc. The statistics feature is enabled by default. Successful exploitation lets an attacker execute arbitrary OS commands with root (Linux/FreeBSD) or SYSTEM (Windows) privileges on the host running the WAF module. Because the product runs as a module inside the web server on the protected host, compromise of the WAF equals compromise of the web server host at the highest privilege level.
JVN (JVN#88474777) and the NVD-mirrored CVE record score the issue CVSS v4.0 8.5 (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) and CVSS v3.0 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), i.e. a local, low-privilege attack path that yields full privilege escalation. Secondary reporting (SecurityOnline, Daily Security Review) states that low-level local access is required. BleepingComputer reports the flaw as exploited to run commands as SYSTEM/root. The vendor and JPCERT/CC confirm exploitation in the wild but have not disclosed the attacker, the initial access method, the number of affected installations, or post-exploitation activity. No IOCs, PoC code or CISA KEV listing have been published as of 2026-10-18.
Affected: SiteGuard Server Edition Ver2.20 and later for Apache httpd, Nginx and IIS (before Ver8.00 Update 5), and Apache httpd/Nginx on FreeBSD (before Ver7.00 Update 6), when the statistics feature is enabled. IIS editions Ver3.10 through Ver4.00 Update 4 are not affected. The vendor notified direct support-contract customers on 2026-09-29, ahead of public disclosure by JPCERT/CC and IPA on 2026-10-14 (JPCERT-AT-2026-0032). For environments that cannot upgrade, including end-of-support versions, the vendor provides a file-replacement patch for the statistics processing files. The vendor advises saving diagnostic information from the admin console (Diagnostics > Download diagnostic information) BEFORE patching, because the update may erase traces of attack. Defenders should treat any unpatched host with the statistics feature on as potentially compromised and hunt for web-server-user or WAF-process child processes and unexpected privileged activity.
MITRE ATT&CK techniques used in TL-2026-3854
Execution
T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1059.004 Command and Scripting Interpreter: Unix Shell
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Affected products and versions in SiteGuard Server Edition WAF OS command injection
- EG Secure Solutions Inc. — SiteGuard Server Edition (Apache httpd, Nginx, IIS; non-FreeBSD)
Vulnerable versions: Ver2.20 through Ver8.00 Update 4 (statistics feature enabled)
Fixed in: Ver8.00 Update 5 - EG Secure Solutions Inc. — SiteGuard Server Edition (Apache httpd, Nginx on FreeBSD)
Vulnerable versions: Ver2.20 through Ver7.00 Update 5 (statistics feature enabled)
Fixed in: Ver7.00 Update 6 - EG Secure Solutions Inc. — SiteGuard Server Edition for IIS Ver3.10 - Ver4.00 Update 4
Fixed in: Not affected
Remediation for SiteGuard Server Edition WAF OS command injection
Patches
- Upgrade to SiteGuard Server Edition Ver8.00 Update 5 (Apache httpd, Nginx, IIS)
- Upgrade to SiteGuard Server Edition Ver7.00 Update 6 (Apache httpd, Nginx on FreeBSD)
Immediate actions
- Download diagnostic information from the SiteGuard admin console (Diagnostics > Download diagnostic information) before patching to preserve evidence of attack
- Inventory all SiteGuard Server Edition installs (Ver2.20+) with the statistics feature enabled
- Hunt for anomalous child processes of the web server / SiteGuard statistics processing and for unexpected root/SYSTEM activity on those hosts
- Restrict local and administrative access to hosts running SiteGuard Server Edition
Workarounds
- Apply the vendor-provided file-replacement patch for the statistics processing files where upgrade is not possible, including end-of-support versions
Longer-term hardening
- Monitor vendor and JPCERT/CC advisories for published indicators
- Retire end-of-support SiteGuard versions or keep them on the vendor file-replacement patch
- Alert on privileged command execution spawned from web server processes
CVEs associated with SiteGuard Server Edition WAF OS command injection
Weaknesses (CWE) in SiteGuard Server Edition WAF OS command injection
Timeline of SiteGuard Server Edition WAF OS command injection
- EG Secure Solutions notifies direct support-contract customers of the SiteGuard Server Edition OS command injection vulnerability and confirmed exploitation
- JPCERT/CC and IPA issue alert JPCERT-AT-2026-0032 confirming the flaw is exploited in the wild
- JVN#88474777 and CVE-2026-106931 published (CVSS v4.0 8.5 / v3.0 7.8); vendor posts public security alert 202610-1
- SecurityOnline and Daily Security Review report JPCERT/CC's confirmation of exploitation, noting low-level local access is required; EPSS 0.7% (30-day) cited; not listed in CISA KEV
- ScanNetSecurity reports the vulnerability and fixed versions Ver8.00 Update 5 / Ver7.00 Update 6
- BleepingComputer reports hackers exploiting the SiteGuard WAF flaw to run commands as SYSTEM/root; no attacker, IOCs or PoC disclosed
- Cyber Security News reports hackers exploiting the SiteGuard WAF vulnerability with potential full control of servers; no new technical details, attacker or IOCs disclosed
Update history for TL-2026-3854
- 2026-10-19 — SiteGuard Server Edition WAF OS Command Injection (CVE-2026-106931) Under Active Exploitation: What changed No severity, exploitability, status or CVSS change; existing record already ACTIVE/HIGH and already cites both CVSS v4.0 8.5 and v3.0 7.8. New indicators (1) 1 new behavioral item: the statistics feature as exposure condition,
Sources cited for SiteGuard Server Edition WAF OS command injection
- Hackers exploit SiteGuard WAF flaw to run commands as SYSTEM, root
- JVN#88474777: SiteGuard Server Edition OS command injection vulnerability
- EG Secure Solutions SiteGuard security alert 202610-1
- CVE-2026-106931 - OpenCVE record
- SiteGuard Server Edition に OS コマンドインジェクションの脆弱性 (ScanNetSecurity)
- SiteGuard CVE-2026-106931 exploited (SecurityOnline)
- JPCERT/CC Warns SiteGuard WAF Flaw CVE-2026-106931 Is Exploited (Daily Security Review)
Detection coverage for TL-2026-3854
As of 2026-10-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3854 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.