- What was announced in October 2026 for Japanese products small companies often use
- What "exploitation confirmed" means
- Why to keep evidence before updating
- How to think about versions whose support has ended
- A message you can send to your vendor
Short answer
In October 2026, vulnerabilities that are already being exploited were announced in two Japanese products that many online shops and company websites use: the AmazonPay plugin for EC-CUBE 4 and SiteGuard Server Edition, which protects web servers. In the same month, serious fixes were also released for Movable Type. If an outside company builds or runs your site, start by asking them: "Do we use any of these, and has it been dealt with?"
What was announced in October 2026
The main points, from JVN, JPCERT/CC and IPA:
| Product (announced) | What | Exploitation |
|---|---|---|
| AmazonPay plugin for EC-CUBE 4 (Oct 14) | Customers may be redirected to another site during checkout | Attacks confirmed by the developer |
| SiteGuard Server Edition (Oct 14) | Attackers may run any command on the server with the highest privileges | Exploitation confirmed by the developer |
| Movable Type (Oct 7) | Attackers may run arbitrary program code or database commands | Not stated on the IPA page |
The AmazonPay plugin issue is in a plugin built into EC-CUBE, not in the Amazon Pay payment service itself. For this plugin, JVN says the redirected customer's account details and other information could be stolen. Affected versions are the V2 plugin for 4.0/4.1 v1.0.0 to v1.1.12, the V2 plugin for 4.2/4.3 v4.2.0 to v4.3.1 (including the bundled v4.3.1), and the AmazonPay plugin for 4.0 v1.3.0 and earlier. JVN's advice is to apply the patch according to the developer's information; the JVN page does not list fixed version numbers. Check the EC-CUBE developer's own notice for the exact steps.
SiteGuard Server Edition is affected when its statistics feature is on, and that feature is on by default. The fixed versions are Ver8.00 Update5 for the Apache, Nginx and IIS editions, and Ver7.00 Update6 for the FreeBSD Apache and Nginx editions. A patch is also available for users who cannot update, and the developer says it covers versions whose support has ended. On October 20, the US agency CISA added this flaw to its Known Exploited Vulnerabilities (KEV) catalog.
For Movable Type, CVE-2026-96408 is rated CVSS 9.4 (critical) and CVE-2026-103668 is rated 8.6 (important). The fixed versions are 9.3.0, 9.0.10, 8.8.6 and 8.0.13, and for Movable Type Premium, 9.3.0, 9.0.10 and 2.18.
Decide the order by whether the flaw is known to be exploited, before looking at the severity score.
What "exploitation confirmed" means
Some announcements say "a weakness was found". Others say "it is already being used in attacks". The second kind means attackers know how to use the flaw and are actually trying it. Assume you are being targeted in the gap between the announcement and your fix.
The AmazonPay plugin flaw has a CVSS score of 4.7 (v3) and 5.3 (v4). On the score alone, it does not look urgent. But since attacks have been confirmed, a customer really could be sent to a fake site in the middle of an order. Look first at whether exploitation is confirmed, then at the score, when deciding what to fix first.
Keep the evidence before you update
For SiteGuard Server Edition, the developer says updating or patching may erase traces of an attack. It asks users to go to Diagnostic Information in the web admin screen, download the diagnostic information and keep it before updating. JPCERT/CC recommends the same.
Closing the hole does not tell you whether someone got in before you closed it. If the traces are gone, you lose the clues you would need later to find out what happened. When you ask your maintenance company to update, add one line: "Please download and keep the diagnostic information first." As a stopgap, JPCERT/CC also mentions turning off the statistics feature; follow the developer's instructions for that.
If you use a version whose support has ended
For Movable Type, IPA says that the end-of-support 8.4 series, 7 series and earlier, and Movable Type Premium 1 series are also affected. These series are not in the list of fixed versions. For sites that cannot update, the workarounds are to delete certain files or remove their execute permission, or to restrict the features in the configuration.
A workaround only buys time until you move to a fixed version. Say your company site was built ten years ago and still runs an old version: apply the workaround now, then agree with your vendor on a date to move to a supported version. If rebuilding costs money, remember when you compare options that you will face the same decision every time a new flaw is announced.
What to ask your vendor or maintenance company
Only the people who built or run your site know exactly which products and versions it uses. Asking these five questions, for example, tells you whether action is needed.
Checklist
- Does our site or online shop use the EC-CUBE AmazonPay plugin, SiteGuard Server Edition or Movable Type?
- If so, have the October fixed versions or patches been applied? If not yet, when?
- If we use SiteGuard, was the diagnostic information downloaded and kept before updating?
- Are we on any version whose support has ended? If so, is there a plan for when to move?
- When an announcement like this comes out, who notices it, and how soon does our contract say we will be told?
You can copy this message into an email or chat as it is.
Hello,
In October, vulnerabilities were announced in the EC-CUBE AmazonPay plugin, SiteGuard Server Edition and Movable Type. The first two are reported to be already exploited.
Could you tell us whether our website or online shop uses any of these?
If it does, please let us know whether the fixed versions or patches have been applied, or when they will be.
If we use SiteGuard, could you download and keep the diagnostic information before updating?
If we are on a version whose support has ended, we would also like to discuss next steps.
If any of this falls outside our maintenance contract, please let us know.Things to watch
If your vendor replies "we don't use those", do not stop there. Plugins and components are sometimes added during the original build and forgotten after the person in charge changes. If they are not sure, ask them to check before answering and agree on a date for the reply.
This article covers only the October 2026 announcements that small companies are likely to be affected by. More information or further fixes may follow. For the exact affected versions and steps, check the latest information from JVN, JPCERT/CC, IPA and each developer.
Summary
- In October 2026, already-exploited vulnerabilities were announced in the EC-CUBE AmazonPay plugin and SiteGuard Server Edition.
- Decide what to fix first by whether exploitation is confirmed, not by the score alone.
- For SiteGuard, download and keep the diagnostic information before updating.
- For end-of-support versions, use the workaround to buy time and set a date to move.
One thing to check today
Send the message above to the company that builds or maintains your site.