EG Secure patches exploited SiteGuard flaw that can grant full server control
EG Secure's default-enabled statistics feature leaves specified Apache httpd, Nginx and IIS releases vulnerable; administrators can upgrade, apply its patch or disable statistics after saving diagnostics.
By Ryan Merket · Published
Primary source: BleepingComputer
Why it matters
A flaw in a host-based WAF can provide a route to root or SYSTEM privileges on the server it is meant to help protect. The advisories confirm exploitation, while leaving the number of exposed or compromised installations unknown.
Tokyo-based EG Secure Solutions, founded in 2008 by web-security specialist Hiroshi Tokumaru, disclosed an actively exploited command-injection flaw in its SiteGuard Server Edition web application firewall on October 14th. The vulnerability, CVE-2026-106931, is in the product's statistics feature, which is enabled by default.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.