An OS command injection vulnerability exists in EGセキュアソリューションズ' hosted WAF SiteGuard Server Edition, and exploitation has been confirmed. Users have been advised to update to the latest version and apply the patch, with the affected scope and countermeasures disclosed.
On 14 October, EGセキュアソリューションズ disclosed that its hosted WAF SiteGuard Server Edition had an OS command injection vulnerability (CVE-2026-106931), stating that exploitation of the vulnerability had already been confirmed. The affected product versions are Ver2.20 and later, excluding IIS versions Ver3.10 to Ver4.00 Update4. The CVSS score was 7.8 under version 3.1 and 8.5 under version 4.0.
As a countermeasure, users can address the issue by updating the Apache, Nginx and IIS versions to Ver8.00 Update5 or later, and the FreeBSD Apache and Nginx versions to Ver7.00 Update6 or later. It was also explained that, when the statistical function is enabled by default, an attacker may be able to execute arbitrary OS commands with root or SYSTEM privileges.
EG has also announced a patch that replaces files used for statistical processing for users who have difficulty upgrading, including users of versions that are no longer supported. Because updating or applying the patch may erase traces of exploitation, users were instructed to obtain and retain diagnostic information from the web administration screen before applying the update or patch.