Security researchers and Japanese authorities have confirmed that hackers are actively exploiting a critical OS command injection vulnerability in SiteGuard Server Edition. Tracked as CVE-2026-106931, the flaw allows unauthenticated attackers to execute arbitrary commands with root or SYSTEM privileges on affected web servers.
The vulnerability carries a CVSS 4.0 score of 8.5 and specifically targets the product’s “statistics” feature. Because this feature is enabled by default in most installations, a significant portion of the user base is exposed to immediate risk without manual configuration changes. According to a joint advisory from JPCERT/CC and developer EG Secure Solutions, exploitation in the wild was confirmed as of October 14, 2026.
The exploitation timeline suggests a targeted period of activity prior to public disclosure. While the public was notified in mid-October, the vendor reportedly issued private warnings to direct support customers as early as September 29, 2026.
Scope of Impact and Affected Versions
The vulnerability affects SiteGuard Server Edition across multiple web server environments, including Apache, Nginx, and IIS. Organizations running the following versions are urged to evaluate their exposure:
- Apache/Nginx: Ver2.20 through Ver6.00 and Ver7.00 through Ver8.00 Update 4.
- IIS: Ver2.20 through Ver3.10 and Ver4.00 through Ver5.00 Update 4.
- FreeBSD: Ver2.20 through Ver7.00 Update 5.
According to Japan Vulnerability Notes, the flaw resides in how the statistics management component processes input. Successful exploitation grants the attacker the same permission level as the SiteGuard service, typically allowing for full system takeover, data exfiltration, or the installation of persistent backdoors.
Forensic Preservation and Patching Requirements
EG Secure Solutions has issued a specific warning regarding the remediation process. Administrators are cautioned that applying the update or manual patch may overwrite or delete local logs and attack traces within the statistics directory. To maintain forensic integrity for future investigations, the vendor recommends that administrators download and preserve “Diagnostic information” through the management console before initiating any update.
To mitigate the threat, organizations should update to the following versions immediately:
- Standard Platforms: Ver8.00 Update 5 or later.
- FreeBSD: Ver7.00 Update 6 or later.
- IIS (Legacy): Ver5.00 Update 5 or later.
For environments where an immediate update is not feasible, administrators can temporarily mitigate the risk by disabling the “statistics” feature entirely. This action closes the primary attack vector but will result in the loss of real-time traffic analysis and reporting functionality until the system is fully patched. Even for versions that have reached End-of-Life (EOL), the vendor has provided manual patching instructions to address the critical nature of the active exploitation.
