Attackers Are Escalating to Root Through a Japanese Web Firewall

A command injection flaw in SiteGuard Server Edition, a web application firewall widely deployed in Japan, is being used to run arbitrary commands with root or SYSTEM privileges on the servers it is meant to protect. The vendor, EG Secure Solutions, published the vulnerability on 14 October 2026 and said abuse had already been confirmed. JPCERT/CC issued its own alert, JPCERT-AT-2026-0032, the same day, and Japan Vulnerability Notes carried it as JVN#88474777 at 15:15 that afternoon.

The bug is tracked as CVE-2026-106931 and carries a CVSS v4.0 base score of 8.5 from JPCERT/CC as the assigning authority, with a CVSS v3.0 score of 7.8. It is classified as CWE-78, improper neutralisation of special elements used in an OS command. It affects SiteGuard Server Edition Ver2.20 and later: the Apache, Nginx and IIS editions before Ver8.00 Update5, and the FreeBSD Apache and Nginx editions before Ver7.00 Update6. IIS versions from Ver3.10 to Ver4.00 Update4 are not affected. Exploitation requires the statistics function to be active, and it is on by default.

The fix removes the proof

The unusual instruction in this advisory is not about patching. EG Secure Solutions reports that completing the update to a fixed version may delete the traces of a compromise, and JPCERT/CC repeats the warning. Administrators are told to preserve evidence first, by downloading diagnostic information from the web management screen before they update or apply the patch. For those who cannot upgrade, the vendor offers a patch that replaces the files used in statistics processing, including for versions past end of life. Disabling the statistics function avoids the flaw entirely.

A vendor that writes evidence-preservation steps into a patch advisory is telling its customers something it has not said outright. Routine remediation guidance does not include forensic triage. This one does, which implies the vendor expects a meaningful number of its installations to be already compromised.

Local, and that changes who should worry

The scoring deserves a closer read than the headline severity suggests. The CVSS v4.0 vector published with the CVE specifies AV:L and PR:L, a local attack vector requiring low privileges. This is not an unauthenticated attacker reaching in from the internet. It is an attacker who already has some access to the host turning it into root or SYSTEM. That makes it a second-stage escalation rather than an entry point, and the practical risk concentrates on servers where an initial foothold already exists or where low-privileged accounts are loosely held.

The irony is still worth stating plainly. A web application firewall is a security control bought to sit in front of exposed applications, and the default-enabled statistics feature in this one hands over the whole machine to anyone already partway in. EG Secure Solutions claims SiteGuard protects more than 1.5 million websites, a vendor figure that has not been independently audited.

Two weeks of unequal warning

Customers with direct support contracts were notified on 29 September 2026, the vendor told BleepingComputer, which reported the active exploitation on 18 October. Everyone else learned of it on 14 October. That is a fifteen-day window in which paying support customers could hunt for intrusions and other administrators did not know there was anything to hunt for. Defenders reviewing logs now should go back to at least late September rather than to the disclosure date.

It lands in a dense month for exploited flaws in the products enterprises buy to secure themselves. As Parallax Nexus reported on 17 October, a suspected PRC-nexus actor had root on BeyondTrust Remote Support appliances from late August, and attackers chained three Ivanti zero-days earlier in the month, one of which was still unfixed at disclosure. The pattern is consistent: the administrative and protective layer is where the access is.

Much about this one is still unknown. Neither the vendor advisory nor JPCERT/CC names the attacker, the victims, the number of affected servers or the method used to gain the initial foothold, and no figure has been published for how many installations run a vulnerable version with statistics enabled. JPCERT/CC has asked anyone with information to contact it.