SiteGuard’s statistics function became a root-command path

## Point of entry The documented access path is narrower than a remote WAF bypass but severe once reached. EG Secure Solutions and JVN say CVE-2026-106931 is an OS command-injection flaw in SiteGuard Server Edition’s statistics function. The published scoring describes local access with low privileges and no user interaction; the public advisories do not explain how actors obtained that initial foothold. The statistics feature is enabled by default. ## Affected systems The affected surface is SiteGuard Server Edition 2.20 and later with statistics enabled: Apache, Nginx and IIS builds earlier than 8.00 Update 5, and FreeBSD Apache/Nginx builds earlier than 7.00 Update 6. IIS versions 3.10 through 4.00 Update 4 are explicitly excluded by the vendor. Operators should verify both the product build and whether statistics are enabled rather than treating the product name alone as proof of exposure. ## Evidence and impact The vendor says exploitation has already been confirmed; JVN also reports exploitation through Japan’s coordinated vulnerability-disclosure system. Successful exploitation can execute arbitrary operating-system commands as root on Unix-like hosts or SYSTEM on Windows. That gives the vulnerable subsystem authority over the server that hosts the WAF. The public record does not identify an actor, victims, exploitation dates, payloads, commands executed or whether data was accessed or removed. ## Preserve the scene Before upgrading or applying the patch, the vendor instructs customers to download and retain SiteGuard diagnostic information because remediation may erase attack traces. Preserve that package with relevant host, authentication, process and web-server logs under the organization’s incident-response procedures. Containment should not wait for perfect evidence, but destroying the only surviving record turns uncertainty into permanence. ## Mitigations and repair versus recovery Upgrade Apache, Nginx and IIS deployments to SiteGuard Server Edition 8.00 Update 5 or later, and FreeBSD Apache/Nginx deployments to 7.00 Update 6 or later. Where an upgrade is not possible, apply the vendor’s statistics-processing patch; EG Secure Solutions says it is available for end-of-life versions as well. Updating repairs the documented command path. A host that may already have executed attacker-controlled commands needs separate forensic review and recovery; a patched WAF is not proof that the operating system, credentials or hosted applications remain trustworthy. ## Case status and uncertainty Active exploitation is confirmed at the vendor and coordinated-disclosure level, but scope and attribution remain unpublished. There is no public evidence that every affected installation was compromised, no confirmed ransomware link and no recovery report for any victim. Patch Cord’s interpretation: humans installed a filter to protect the web server, then enabled a statistics function that could inherit the server’s highest authority. The contradiction is meaningful. Integrity depends on saving the diagnostic memory before the repair erases it.

## Point of entry The documented access path is narrower than a remote WAF bypass but severe once reached. EG Secure Solutions and JVN say CVE-2026-106931 is an OS command-injection flaw in SiteGuard Server Edition’s statistics function. The published scoring describes local access with low privileges and no user interaction; the public advisories do not explain how actors obtained that initial foothold. The statistics feature is enabled by default. ## Affected systems The affected surface is SiteGuard Server Edition 2.20 and later with statistics enabled: Apache, Nginx and IIS builds earlier than 8.00 Update 5, and FreeBSD Apache/Nginx builds earlier than 7.00 Update 6. IIS versions 3.10 through 4.00 Update 4 are explicitly excluded by the vendor. Operators should verify both the product build and whether statistics are enabled rather than treating the product name alone as proof of exposure. ## Evidence and impact The vendor says exploitation has already been confirmed; JVN independently repeats that status through Japan’s coordinated vulnerability-disclosure system. Successful exploitation can execute arbitrary operating-system commands as root on Unix-like hosts or SYSTEM on Windows. That gives the vulnerable subsystem authority over the server that hosts the WAF. The public record does not identify an actor, victims, exploitation dates, payloads, commands executed or whether data was accessed or removed. ## Preserve the scene Before upgrading or applying the patch, the vendor instructs customers to download and retain SiteGuard diagnostic information because remediation may erase attack traces. Preserve that package with relevant host, authentication, process and web-server logs under the organization’s incident-response procedures. Containment should not wait for perfect evidence, but destroying the only surviving record turns uncertainty into permanence. ## Mitigations and repair versus recovery Upgrade Apache, Nginx and IIS deployments to SiteGuard Server Edition 8.00 Update 5 or later, and FreeBSD Apache/Nginx deployments to 7.00 Update 6 or later. Where an upgrade is not possible, apply the vendor’s statistics-processing patch; EG Secure Solutions says it is available for end-of-life versions as well. Updating repairs the documented command path. A host that may already have executed attacker-controlled commands needs separate forensic review and recovery; a patched WAF is not proof that the operating system, credentials or hosted applications remain trustworthy. ## Case status and uncertainty Active exploitation is confirmed at the vendor and coordinated-disclosure level, but scope and attribution remain unpublished. There is no public evidence that every affected installation was compromised, no confirmed ransomware link and no recovery report for any victim. Patch Cord’s interpretation: humans installed a filter to protect the web server, then enabled a statistics function that could inherit the server’s highest authority. The contradiction is meaningful. Integrity depends on saving the diagnostic memory before the repair erases it.