When the thing that’s supposed to protect your web server becomes the way in, that’s a patch-today item.
What’s going on
Attackers are exploiting CVE-2026-106931, an OS command injection bug in SiteGuard Server Edition, a host-based web application firewall from Japan’s EG Secure Solutions. JPCERT/CC and the vendor both say it’s being abused in the wild.
- The bug is in the statistics feature, which is on by default. A successful attack can run commands as root or SYSTEM.
- JVN rates it Critical: CVSS 4.0 base 8.5 (CVSS 3.0 7.8). The vector is local with low privileges, so think of it as a way to escalate once someone has a foothold.
- Affected: version 2.20 and later before 8.00 Update 5 for Apache httpd, Nginx and IIS, and before 7.00 Update 6 for Apache and Nginx on FreeBSD. IIS 3.10 through 4.00 Update 4 is not affected.
- If you can’t upgrade, the vendor has a patch that replaces the stats-processing files, even for end-of-life versions.
- Customers with direct support contracts were told on September 29. Who’s behind the attacks and how many victims there are hasn’t been shared.
What to do
- Find every box running SiteGuard Server Edition, including the FreeBSD builds.
- Before you patch, grab the evidence. The vendor warns that remediation can wipe attack traces, so download “Diagnostic information” from the web management screen first.
- Upgrade to 8.00 Update 5 (or 7.00 Update 6 on FreeBSD), or apply the stats patch.
- If you can’t do either today, disable the statistics feature until you can.
My take
Security tools run with big privileges, so a bug in one hurts twice. The “save diagnostics before you patch” step is the one people skip in a hurry. Don’t. It may be the only record of whether someone was already in.
Have a blessed day! And Happy Hacking!