# SiteGuard Server Edition WAF OS command injection (CVE-2026-106931) actively exploited to run commands as SYSTEM/root

> An OS command injection flaw (CWE-78) in the statistics feature, enabled by default, of EG Secure Solutions' SiteGuard Server Edition host-based WAF is exploited in the wild and allows arbitrary OS command execution as root or SYSTEM. Fixed in Ver8.00 Update 5 (Apache httpd/Nginx/IIS) and Ver7.00 Update 6 (FreeBSD).

- **Published:** 2026-10-18T14:51:55Z
- **Last reviewed:** 2026-10-19T12:27:16.984Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3854
- **ID:** TL-2026-3854
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-106931

## Description

CVE-2026-106931 is an OS command injection vulnerability (CWE-78) in the statistics processing feature of SiteGuard Server Edition, a host-based web application firewall from EG Secure Solutions Inc. The statistics feature is enabled by default. Successful exploitation lets an attacker execute arbitrary OS commands with root (Linux/FreeBSD) or SYSTEM (Windows) privileges on the host running the WAF module. Because the product runs as a module inside the web server on the protected host, compromise of the WAF equals compromise of the web server host at the highest privilege level.

JVN (JVN#88474777) and the NVD-mirrored CVE record score the issue CVSS v4.0 8.5 (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) and CVSS v3.0 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), i.e. a local, low-privilege attack path that yields full privilege escalation. Secondary reporting (SecurityOnline, Daily Security Review) states that low-level local access is required. BleepingComputer reports the flaw as exploited to run commands as SYSTEM/root. The vendor and JPCERT/CC confirm exploitation in the wild but have not disclosed the attacker, the initial access method, the number of affected installations, or post-exploitation activity. No IOCs, PoC code or CISA KEV listing have been published as of 2026-10-18.

Affected: SiteGuard Server Edition Ver2.20 and later for Apache httpd, Nginx and IIS (before Ver8.00 Update 5), and Apache httpd/Nginx on FreeBSD (before Ver7.00 Update 6), when the statistics feature is enabled. IIS editions Ver3.10 through Ver4.00 Update 4 are not affected. The vendor notified direct support-contract customers on 2026-09-29, ahead of public disclosure by JPCERT/CC and IPA on 2026-10-14 (JPCERT-AT-2026-0032). For environments that cannot upgrade, including end-of-support versions, the vendor provides a file-replacement patch for the statistics processing files. The vendor advises saving diagnostic information from the admin console (Diagnostics > Download diagnostic information) BEFORE patching, because the update may erase traces of attack. Defenders should treat any unpatched host with the statistics feature on as potentially compromised and hunt for web-server-user or WAF-process child processes and unexpected privileged activity.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1068 Exploitation for Privilege Escalation

## Sources

- [Hackers exploit SiteGuard WAF flaw to run commands as SYSTEM, root](https://www.bleepingcomputer.com/news/security/hackers-exploit-siteguard-waf-flaw-to-run-commands-as-system-root/)
- [JVN#88474777: SiteGuard Server Edition OS command injection vulnerability](https://jvn.jp/en/jp/JVN88474777/)
- [EG Secure Solutions SiteGuard security alert 202610-1](https://www.eg-secure.co.jp/siteguard/news/alert-202610-1)
- [CVE-2026-106931 - OpenCVE record](https://app.opencve.io/cve/CVE-2026-106931)
- [SiteGuard Server Edition に OS コマンドインジェクションの脆弱性 (ScanNetSecurity)](https://scan.netsecurity.ne.jp/article/2026/10/16/56472.html)
- [SiteGuard CVE-2026-106931 exploited (SecurityOnline)](https://securityonline.info/siteguard-cve-2026-106931-exploited/)
- [JPCERT/CC Warns SiteGuard WAF Flaw CVE-2026-106931 Is Exploited (Daily Security Review)](https://dailysecurityreview.com/?p=44598)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3854