A host-based web application firewall is supposed to sit between the internet and your web server. CVE-2026-106931, an OS command injection in EG Secure Solutions’ SiteGuard Server Edition, turns that position against you: successful exploitation runs commands as root on Linux and FreeBSD or SYSTEM on Windows, on the same host that serves your application. CISA added it to the Known Exploited Vulnerabilities catalog on October 20, 2026, with a federal remediation deadline of October 23.
What happened
EG Secure Solutions confirmed in-the-wild abuse and, per reporting, notified customers with direct support contracts on September 29, 2026. JPCERT/CC then published an alert, and CISA’s KEV addition followed. The vendor’s own language is that abuse “has already been confirmed.”
The flaw is classified as CWE-78 (OS command injection) and sits in the product’s statistics feature, which is enabled by default. Published scores are CVSS 4.0 8.5 and CVSS 3.0 7.8. Those scores reflect a local, low-privilege attack vector in the vector string, but the practical risk is higher than the number suggests: the vulnerable component runs with the privileges of the WAF process, so any foothold that can reach the feature, including a compromised low-privileged account or a prior web-app foothold on the same host, becomes full host control.
Public write-ups do not currently describe the post-exploitation tooling or attribute the activity to a named actor. Treat any claim of attribution as unverified.
Affected and fixed versions
Per JPCERT/CC and JVN:
| Edition | Affected | Fixed |
|---|---|---|
| Apache httpd, Nginx, IIS | Ver 2.20 and later, before 8.00 Update 5 | 8.00 Update 5 |
| FreeBSD (Apache httpd, Nginx) | before the 7.00 line fix | 7.00 Update 6 |
IIS editions from Ver 3.10 through Ver 4.00 Update 4 are reported as not affected. Sources disagree slightly on the FreeBSD boundary (the JPCERT text reads “Update5” while the fixed release is Update 6), so confirm against the vendor advisory and JVNDB-2026-000148 rather than relying on a summary.
For end-of-life versions that cannot move to a supported release, the vendor is providing a targeted patch that replaces the files used in statistics processing.
Why patching is not the first step
The vendor and JPCERT/CC both advise preserving diagnostic information before updating, because the update can overwrite artifacts that show whether the host was already compromised. In the SiteGuard web management console, download the diagnostic information bundle first. A clean upgrade is not evidence of a clean host.
Recommended order of operations:
- Export diagnostic information from the management screen and copy it off-host.
- Snapshot the VM or take a disk image if your platform allows it.
- Apply 8.00 Update 5 / 7.00 Update 6, or the targeted patch for legacy builds.
- Hunt for compromise (below) and rotate any credentials, TLS keys and API tokens that were readable by root/SYSTEM on that host.
Mitigation and detection
- Disable the statistics feature if you cannot patch immediately. JPCERT/CC states this avoids the vulnerable code path; the vendor advisories do not list it as an official workaround, so confirm with EG Secure Solutions.
- Restrict access to the SiteGuard management interface and to any account able to reach the statistics function to a dedicated admin network.
- Review the host for unexpected child processes of the SiteGuard service, new cron entries or systemd units, new local users or SSH keys, and Windows services or scheduled tasks created around the exposure window, which per the vendor begins no later than late September.
- Because the WAF host terminates or inspects traffic for the protected application, assume session secrets and TLS private keys on the box are exposed if compromise is confirmed.
Why it matters
Security products are high-value targets precisely because they run with high privilege and sit in trusted network positions. This is the same pattern seen across edge appliances this year: a default-on management or reporting feature, an injection bug, and a root shell on a device that defenders assume is protecting them. Federal agencies have already blown past the KEV deadline; everyone else running SiteGuard Server Edition should treat this as an active-incident-response task, not a routine patch cycle.