Attackers are exploiting a SiteGuard Server Edition flaw that can execute operating-system commands as root or SYSTEM on affected servers, according to EG Secure Solutions and Japan Vulnerability Notes (JVN). BleepingComputer reported the attacks on October 18, 2026. Tracked as CVE-2026-106931, the vulnerability affects the web application firewall’s statistics feature when enabled, its default setting.

The Japanese vendor disclosed the vulnerability publicly on October 14 after notifying customers with direct support contracts on September 29. JPCERT/CC says the product is widely used in Japan and urges affected operators to consider remediation and compromise investigations. The advisories do not identify attackers, victims or the scale of exploitation.

JVN describes an OS command-injection weakness in the host-based firewall, which integrates into a web server. Its CVSS 4.0 score is 8.5, with a vector specifying local access, low privileges and no user interaction. The documented impact is privileged command execution on the server running the product; the public advisories do not describe the attack chain used in observed incidents.

According to the vendor, affected releases start at version 2.20 and extend to versions before 8.00 Update 5 for Apache httpd, Nginx and IIS, excluding FreeBSD. Apache httpd and Nginx installations on FreeBSD require 7.00 Update 6. IIS versions 3.10 through 4.00 Update 4 are excluded. These affected-version conditions apply when statistics processing is enabled.

The vendor provides fixed releases and a separate patch replacing statistics-processing files for installations that cannot upgrade, including versions beyond support. Before either remedy, administrators should download and retain diagnostic information through the web management interface. EG Secure Solutions warns that updating or patching may remove traces of an attack.

JPCERT/CC also identifies disabling the statistics feature as a workaround and directs operators to the vendor’s instructions. Its guidance pairs corrective action with investigation of possible compromise. Organizations can consult the [vendor bulletin](https://www.eg-secure.co.jp/siteguard/news/alert-202610-1) and [JPCERT/CC advisory](https://www.jpcert.or.jp/at/2026/at260032.html) for remediation and evidence-preservation details.