SiteGuard Server Edition from EG Secure Solutions has CVE-2026-106931, an OS command injection in a statistics function, scored 8.5 under CVSS v4.0. Exploitation yields root or SYSTEM on the appliance. CISA added it to the KEV catalogue with a November deadline, and the vendor's own guidance notes that patching can destroy evidence of intrusion, which is a sentence that tells you the vendor expects compromised installations.
ZoomEye could not be queried during this research window because the API returned HTTP 502. Rather than present a count, this article addresses a question that arises constantly with products of this kind: what does it mean when a search returns nothing at all.

Why zero is a legitimate result

SiteGuard is a Japanese web application firewall, sold primarily into the Japanese market, frequently deployed in front of web servers on hosting and e-commerce estates. Its install base is in the thousands rather than the millions, and a meaningful share of those installations sit behind CDNs or are configured to serve the WAF's block page only on attack.
A global product query against this population can plausibly return single digits, and a query filtered by country returns even fewer. That is not a tool failure. It is the tool working correctly against a small population.
The mistake to avoid is treating a zero result as evidence that nothing is exposed, and then reporting that as a clean bill. Absence of fingerprint is not absence of installation.

Reasons a niche product under-reports

Five mechanisms, all of which apply here.
The product serves a block page rather than its own identity. A WAF intercepts requests; the response a scanner receives is the block page, not the WAF. Fingerprinting a transparent proxy requires the proxy to leak something, and well-configured ones do not.
The product is on a private network. SiteGuard deployed in front of an internal application, or in front of an application that is itself behind a VPN gateway, has no public surface.
The product name differs by locale. A vendor selling into Japan may present product strings in Japanese in page titles and certificate fields, and an English app= query misses them.
The CDN terminates. When a WAF sits behind a CDN, the certificate and server header belong to the CDN's edge.
The population is genuinely small. This is the most common explanation and the least interesting.

Turning a near-zero result into evidence

A defensible measurement note for a product like this has a specific shape. It states the queries, the exact filters, the date, and the result, and then it states what the result cannot distinguish.

app="SiteGuard"
title="SiteGuard"
http.html="SiteGuard"
country="JP" && title="SiteGuard"

Running the English and the Japanese-facing variants and reporting both is better practice than running one and reporting the higher figure. Where a country filter is used, saying so explicitly prevents a reader from generalising a regional count to a global one.
The most useful addition is a control. Run the same query shape against a product you know is large, such as a widely deployed WAF or a major CMS. If that returns the expected volume, the methodology is working and the zero is a real finding about the small product. If both return zero, the query syntax is wrong.

Why this product class deserves attention anyway

Small install base is not the same as small consequence. A WAF sits at the edge of everything it protects, and command injection with root privileges on that box is a position from which an attacker can read traffic, alter responses, or disable the control entirely.
KEV listing alongside active exploitation changes the calculation. The question for an organisation is not "how many SiteGuard instances exist on the internet" but "do we run one, and can we prove it is patched". The first question is answerable by scanning and, for this product, poorly. The second is answerable only by inventory.
Vendor guidance that recommends exporting logs before patching adds an operational constraint worth planning for rather than discovering during an incident.

References

  • NVD entry for CVE-2026-106931, CWE-78, CVSS v4.0 8.5, OS command injection in a statistics function

  • CISA Known Exploited Vulnerabilities catalogue entry for CVE-2026-106931

  • EG Secure Solutions advisory for SiteGuard Server Edition

  • ZoomEye official MCP search syntax reference for app, title, http.html and country