EG Secure Solutions has confirmed that cybercriminals are actively exploiting CVE-2026-106931 in SiteGuard Server Edition, a web application firewall installed directly on the protected server.
The flaw resides in the statistics processing function, which is enabled by default, and permits command injection that grants attackers the ability to run system commands as root on Unix or SYSTEM on Windows.
Security researchers assigned the weakness CWE-78 and scored it 8.5 on CVSS 4.0 and 7.8 on CVSS 3.0. Both ratings describe a local attack vector requiring low privileges and no user interaction.
While the published severity reflects the absence of confirmed remote unauthenticated exploitation, the high-privilege position of an on-server WAF makes successful compromise particularly impactful compared to typical application plugins.
Affected installations include all versions from 2.20 when statistics are active. Apache, Nginx, and IIS editions outside FreeBSD require updates up to 8.00 Update 5, while FreeBSD deployments with Apache or Nginx need 7.00 Update 6. IIS editions between 3.10 and 4.00 Update 4 remain unaffected.
The vendor alerted customers holding direct support contracts on 29 September. JVN published its advisory on 14 October, and JPCERT/CC issued a corresponding alert. Neither organization identified specific threat actors, targeted organizations, attack volume, or exact exploitation methods.
Administrators unable to apply the official update can obtain a patch that replaces the statistics processing files, including for versions whose support has ended. An immediate workaround is to disable the statistics function entirely.
Because the corrective patch removes traces of prior compromise, organizations are advised to first download diagnostic information through the web interface option labeled Information of Diagnosis before applying any fix.
