Before anyone reaches for the SiteGuard Server Edition update, the vendor wants diagnostic data pulled off the box and saved. Supporting that request is a confirmed in-the-wild attack: EG Secure Solutions says an OS command injection bug in the Japanese WAF is already being worked by intruders, and it issued an urgent alert.
Tracked as CVE-2026-106931, the flaw hands whoever exploits it command execution as root on Linux or as SYSTEM on Windows — and SiteGuard runs on the very web server it is supposed to shield. Its statistics feature, shipped switched on, is the piece at fault.
Two severity grades cover it: 8.5 under CVSS 4.0 and 7.8 under the 3.0 scale, assigned by the vendor alongside JVN. Local access and low-level privileges are the preconditions, a profile that reads far more like use after a system is already compromised than like a front-door attack.
Version 2.20 is where the vulnerable range opens. Everything before 8.00 Update 5 is exposed on Apache, Nginx and IIS, FreeBSD aside; FreeBSD installations running Apache or Nginx are exposed below 7.00 Update 6. IIS releases 4.00 Update 4 through 3.10 carry no exposure, and deployments that switched the statistics function off are safe too.
No upgrade path available? A patch that swaps out the files statistics processing relies on exists, and end-of-life versions are covered by it. Sequence still matters: an update overwrites the evidence an intruder leaves, so save the diagnostic information from the management console first.
Direct support customers heard about it on September 29. Not until October 14 did the public alert and the JVN advisory appear, so everyone outside that group absorbed roughly two extra weeks of exposure.
