- EG-Secure Solutions reports an actively exploited command injection flaw, CVE-2026-106931, in the statistics feature of SiteGuard Server Edition 2.20 and later. The feature is on by default.
- BleepingComputer reports attackers can run commands as root or SYSTEM. The attackers, victims and scale remain unknown, because neither advisory gives these details.
- Download the diagnostic information before patching, because the update may remove attack traces. Then confirm versions, check the servers for compromise and name an owner for vendor notices.
A firewall is the guard at the door. The SiteGuard flaw shows what happens when the guard has a master key and someone learns to fool it. The lesson here is that a security tool's privileges are part of an organisation's attack surface. The more power a defender holds, the more an attacker gains from its bugs.
What the vendor says is happening
EG-Secure Solutions, the maker of SiteGuard, reports an OS command injection flaw in SiteGuard Server Edition. It is tracked as CVE-2026-106931. The vendor states that abuse has already been confirmed.
The flaw sits in the product's statistics feature. The vendor says it affects customers on version 2.20 or later with that feature turned on. The feature is on by default.
BleepingComputer reports that attackers can use the flaw to run commands with root or SYSTEM privileges. Those are the highest access levels on Linux and Windows machines.
That figure is the vendor's claim for the SiteGuard brand as a whole. The number of Server Edition installs exposed to this flaw is unknown.
How this kind of flaw works
Operating-system command injection is a simple idea. A program takes text from a user and passes it to the operating system as part of a command. If the program does not clean that text, an attacker can add commands of their own. The machine then obeys them.
The sources do not explain how attackers reach the statistics feature. They also do not say what the attackers actually run.
The privilege level is the real story. SiteGuard Server Edition is a host-based firewall, meaning it runs on the web server itself. Commands that run through it land on the machine it was installed to protect. BleepingComputer reports they run as root or SYSTEM.
A system running as root can read any file, change any setting and install anything. An attacker with that access does not need to defeat the firewall. The firewall's own flaw has already put them inside.
The patching dilemma
The vendor adds an unusual instruction. Before updating, administrators should download the "diagnostic information" from the web management screen and keep it. The vendor says the update may remove traces of an attack.
Picture the administrator on call. Speed says patch now. Investigation says capture the evidence first. The vendor's advice resolves the tension, but only for those who read it before they act.
A patched server is not proof of a clean server. If the flaw was already used, the attacker may still have access.
What is still unknown
BleepingComputer states that neither the vendor's advisory nor Japan's CERT warning names the attacker or the victims. They also give no scale of attacks or methods used. The public record does not show how far this has spread.
Fixes are split by platform. BleepingComputer lists Apache httpd, Nginx and IIS editions (excluding FreeBSD) before 8.00 Update 5 as vulnerable. FreeBSD editions for Apache and Nginx are vulnerable before 7.00 Update 6. Per JPCERT/CC, the IIS releases numbered 3.10 to 4.00 Update 4 do not carry this flaw.
Where an upgrade is not possible, the vendor supplies a file swap for the components that handle statistics. BleepingComputer says this reaches end-of-life releases too.
Who heard, and when
The vendor says it notified customers with support contracts individually on September 29, 2026. The public alert came later; BleepingComputer reported it on October 18.
That makes the notice channel a risk of its own. The vendor points to the support desk or the reseller that sold the product. An organisation that bought through a reseller may not know who receives such notices.
Questions to put to your team
Do we run SiteGuard Server Edition, and on which version? Is the statistics feature switched on? Who owns that decision?
Has anyone downloaded the diagnostic information before patching? Has someone reviewed the server for signs of compromise? The sources do not say when exploitation began, so the review window should not be assumed to be short.
Who receives vendor notices for security products we bought through a reseller? Do we hold a list of tools that run with root or SYSTEM rights on our servers?
A guard with every key puts the lock on its own door at the centre of the plan.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: EG-Secure Solutions (SiteGuard vendor).
