CVE-2026-106931: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
SiteGuard Server Edition, a web server WAF module from EG Secure Solutions, has an OS command injection flaw in its statistics feature, which is on by default. A local user with low privileges can run commands as root or SYSTEM. The vendor confirms exploitation in the wild and CISA lists it as known exploited. Fixed in Ver8.00 Update 5 (Ver7.00 Update 6 on FreeBSD).
Published Oct 14, 2026 · Updated Oct 21, 2026 · Analysis Oct 21, 2026
What an attacker can do
SiteGuard Server Edition runs inside Apache httpd, Nginx or IIS and filters web requests. The vulnerable code is in its statistical processing, and the flaw applies when the statistics feature is enabled, which is the default. Input reaches an OS command without being neutralized (CWE-78), and the module runs with root or SYSTEM privileges.
The CVSS vector says local access, low privileges and no user interaction. The attacker therefore needs a foothold first, such as a low-privilege account or code running as the web server user, from a web shell or another bug. From there, command injection lifts them to root or SYSTEM, which means full control of the web server host. The sources do not describe the exact injection point or the observed attack chain.
The vendor notice says the flaw is confirmed to be exploited in the wild, and CISA added it to the KEV catalog on 2026-10-20.
Who is affected
Affected: SiteGuard Server Edition Ver2.20 and later, on Apache httpd, Nginx and IIS. For IIS, versions from Ver3.10 to Ver4.00 Update 4 are not affected. The flaw applies only when the statistics feature is enabled, and that is the default.
The vendor bulletin and JVN advisory do not document a version command here. Check the installed version through your SiteGuard installation or package information, and read the vendor notice at the EG Secure Solutions site for how to confirm the version and statistics setting.
How to fix it
Upgrade to a fixed version: Ver8.00 Update 5 for Apache httpd, Nginx and IIS, or Ver7.00 Update 6 for Apache httpd and Nginx on FreeBSD.
If you cannot upgrade, the vendor offers a patch that replaces the files used in statistical processing. It is also available for end-of-life versions. The advisory lists no other workaround.
CISA's required action: apply mitigations in accordance with vendor instructions, follow BOD 26-04 guidance and CISA's forensics triage requirements, or discontinue use of the product if mitigations are unavailable. The due date is 2026-10-23. It binds US federal agencies.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
How to tell if you were hit
Because exploitation is confirmed, do not stop at patching. Review web server host logs for commands run as root or SYSTEM by the web server process or the SiteGuard module, new accounts, new scheduled tasks or cron jobs, and unexpected files in web roots. CISA's forensics triage requirements apply to federal agencies. Check the vendor notice and JVN advisory for any indicators they publish. This analysis found none.
Original advisory
From the National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
Questions
- Is CVE-2026-106931 exploited in the wild?
Yes. The vendor says exploitation is confirmed, and CISA added it to the KEV catalog on 2026-10-20 with a due date of 2026-10-23.
- Is the vulnerable statistics feature on by default?
Yes. The vendor says the product is vulnerable when the statistics feature is enabled, and it is enabled by default.
- Can I fix an end-of-life SiteGuard version?
The vendor's patch replaces the files used in statistical processing and is available even for end-of-life versions.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. The analysis is written by an AI model from the sources listed above and checked by automated rules before it is published. Check versions against the vendor's advisory before you act. Methodology