A web application firewall is usually trusted as a source of truth about traffic. CVE-2026-106931 challenges that assumption directly, because it grants command execution on the server where SiteGuard Server Edition runs, and that server also holds the filtering controls and the statistics the product collects.

The vulnerability is OS command injection (CWE-78) in the SiteGuard statistics feature, documented in JVN#88474777 and the vendor alert from EG Secure Solutions, both published 14 October 2026. The ratings are CVSS 4.0 base 8.5 (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) and CVSS 3.0 base 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation produces arbitrary command execution as root, or SYSTEM on IIS, on the hosting server. Both notices confirm the flaw has been exploited.

The trust problem in one paragraph

SiteGuard Server Edition is a host-based WAF that runs inside the infrastructure it protects. If an attacker reaches the statistics path and injects a command, the resulting process runs as the product's privileged account on that same host. Anything the WAF observed about the intrusion can now be read, altered or deleted by that attacker. Logs shipped off the host before the compromise remain credible. Logs that exist only there do not.

Scope before investigation

The affected range is SiteGuard Server Edition Ver2.20 and later with the statistics feature enabled, which is the default. Fixed versions are 8.00 Update 5 for Apache, Nginx and IIS, and 7.00 Update 6 for Apache and Nginx on FreeBSD. IIS editions Ver3.10 through Ver4.00 Update 4 are not affected. Customers who cannot upgrade can use the vendor patch that replaces the statistics processing files, which the vendor makes available for end-of-life versions too.

The evidence instruction is the important part

The vendor tells administrators to download the diagnostic information from the web management screen before updating or patching, with the warning that the process may erase traces of an attack. Read that as a statement about evidence: the vendor expects traces to exist on some installations and expects the update to remove them.

For an investigation, that archive is a snapshot of product state taken at a known moment. It is worth capturing per host, with the hostname, platform, installed version and whether statistics was enabled recorded alongside it. Timestamps matter, since the archive proves nothing if the collection time cannot be tied to the incident window.

What the advisory does not give you

There is no published exploitation technique, no list of indicators of compromise, no attacker attribution and no count of affected systems. Anything an investigator concludes about attacker behaviour has to come from the host rather than from the advisory. That is a constraint on scope statements, not a reason to skip collection.

Two general starting points follow from the flaw class. Command injection executed through a service account leaves traces in the process tree of the web server and its child processes, and in audit or command history where those are enabled. Administrative access to the SiteGuard management interface also deserves review, because the same host holds the credentials and configuration for the filter. Neither check is vendor-certified detection logic, and both should be fitted to the logging the host actually keeps.

Exposure context

ZoomEye reported 507 assets for app="SiteGuard" and 0 for vul.cve="CVE-2026-106931" at the time of writing. The product figure indicates how many SiteGuard-fingerprinted hosts are internet-visible. It cannot discriminate between patched, exempt and statistics-disabled installations, and it says nothing about which hosts were attacked.

Choosing the response order

Export diagnostics first. Confirm version, platform and statistics state second. Patch third. Review host-level activity for the window from the private notification on 29 September 2026 through the public disclosure on 14 October 2026, plus the days around it, fourth. That order keeps the only locally produced evidence in hand before any action that could erase it, and it leaves the patch itself as a separate, verifiable step rather than a substitute for investigation.

References

  • JVN#88474777: https://jvn.jp/en/jp/JVN88474777/

  • EG Secure Solutions alert (Japanese): https://www.eg-secure.co.jp/siteguard/news/alert-202610-1

  • Security Affairs, confirmed exploitation and dates: https://securityaffairs.com/201258/security/japans-siteguard-waf-flaw-cve-2026-106931-is-already-being-exploited.html

ZoomEye records: app="SiteGuard" = 507, vul.cve="CVE-2026-106931" = 0. Search link: https://www.zoomeye.ai/searchResult?q=YXBwPSJTaXRlR3VhcmQi