SiteGuard Server Edition
Host-based web application firewall from EG Secure Solutions.
On 14 October, EG Secure Solutions confirmed active exploitation of a SiteGuard Server Edition command-injection flaw that could run commands with root or SYSTEM privileges.
Last refreshed: 22 October 2026 · Appears in 1 active topic
Could patching SiteGuard erase the evidence of compromise?
Timeline for SiteGuard Server Edition
SiteGuard hit; Qilin posts Keio files
Cybersecurity: Threats and DefencesBackground
SiteGuard Server Edition is a host-based web application firewall developed by EG Secure Solutions in Japan. It runs alongside Apache, nginx and Microsoft IIS web servers, inspecting requests before they reach the protected application. Unlike a network appliance placed in front of many systems, it is installed on the server it protects.
That position lets SiteGuard examine web requests close to the application, but it also places the product inside a sensitive trust boundary. A flaw in the firewall itself can expose the underlying operating system rather than merely allowing a malicious request through to a website. Administrators must therefore treat the product as privileged server software. Its purpose is defensive, yet its access and placement mean that updating, configuration control and review of diagnostic data all form part of the protected server's security.
Attackers exploit SiteGuard's statistics function
On 14 October, EG Secure Solutions confirmed that attackers were exploiting CVE-2026-106931 in SiteGuard Server Edition's statistics function. The command-injection flaw could let an attacker run operating-system commands with root or SYSTEM privileges. JPCERT/CC issued an emergency alert the same day.
Operators faced an evidence-preservation problem as well as a patching task. The vendor and JPCERT/CC told them to save diagnostic data before updating because remediation could erase traces needed to investigate an intrusion. For SiteGuard users, the warning made response order important: preserve the evidence needed to establish what happened, then remove the vulnerable condition and review the server for commands run with elevated privileges.
What is SiteGuard Server Edition?
What is CVE-2026-106931 in SiteGuard?
How do operators fix the SiteGuard vulnerability?
Why should SiteGuard diagnostic data be saved before patching?
Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 22 October 2026. Editorial standards.