CVE-2026-106931: SiteGuard Server Edition statistics feature OS command injection (root)

Exploited in the wild High 8.5 EPSS 2.5% Apache HTTP Server

SiteGuard Server Edition, a host-based WAF module for Apache httpd, Nginx and IIS from EG Secure Solutions, has an OS command injection in its statistics feature that can run arbitrary OS commands as root (or SYSTEM). The statistics feature is enabled by default; JPCERT/CC scores it CVSS 4.0 8.5 (local, low-privileged attacker). EG Secure Solutions and JVN confirm exploitation in the wild, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-20.

CVE-2026-106931CVE identifier
8.5CVSS 4.0 base score (high)
2026-10-20added to CISA's exploited list (US federal deadline 2026-10-23)
2.5%EPSS: chance of exploitation in the next 30 days (higher than 85% of CVEs)
2026-10-14published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

What to do now

Check whether you run Apache HTTP Server and which version (commands below).
Install the fixed version for your system: see “Patch it” below.
sudo systemctl restart apache2 (Debian/Ubuntu/SUSE) or httpd (RHEL/Fedora/Arch/Amazon); FreeBSD: service apache24 restart
If you cannot patch today, apply the temporary mitigation below and patch as soon as possible.
Because this flaw is being exploited, also check the server for signs of compromise.

Affected and fixed versions

Affected:

SiteGuard Server Edition for Apache httpd and Nginx: Ver2.20 and later, before Ver8.00 Update 5
SiteGuard Server Edition for Apache httpd and Nginx on FreeBSD: Ver2.20 and later, before Ver7.00 Update 6
SiteGuard Server Edition for IIS: Ver2.20 and later before Ver8.00 Update 5, except Ver3.10 to Ver4.00 Update 4 (not affected)
Only when the statistics feature is enabled (the default)

Fixed in:

SiteGuard Server Edition Ver8.00 Update 5 (Apache httpd, Nginx, IIS)
SiteGuard Server Edition Ver7.00 Update 6 (Apache httpd and Nginx on FreeBSD)

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

Debian

sudo apt update
sudo apt install --only-upgrade apache2 apache2-bin

Ubuntu

sudo apt update
sudo apt install --only-upgrade apache2 apache2-bin

RHEL, AlmaLinux, Rocky, Oracle

sudo dnf upgrade --refresh httpd

Fedora

sudo dnf upgrade --refresh httpd

SUSE / openSUSE

sudo zypper refresh
sudo zypper update apache2

Amazon Linux

sudo dnf upgrade --releasever=latest httpd

Arch Linux

sudo pacman -Syu

Alpine

apk update && apk upgrade apache2

FreeBSD

pkg update && pkg upgrade apache24

Built from source

# Update to Ver8.00 Update 5 (FreeBSD: Ver7.00 Update 6) using the package from EG Secure Solutions,
# or apply the vendor patch that replaces the statistics-processing files (also offered for EOL versions;
# obtain it via your support contract / reseller).
# BEFORE updating: web admin UI -> [Diagnostic information] -> [Download diagnostic information] and keep the file,
# because updating or patching may erase traces of an attack.

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

If you cannot patch yet

The flaw is only reachable when the statistics feature is enabled (enabled by default), per the vendor and JVN.

Look for signs of exploitation

Before updating or patching, download and preserve the SiteGuard 'diagnostic information' from the web admin UI (Diagnostic information > Download diagnostic information); the vendor warns the update can erase attack traces.

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

https://www.eg-secure.co.jp/siteguard/news/alert-202610-1 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-106931

Sources

Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.