Overview
CISA added CVE-2026-106931, an OS command injection (CWE-78) in EG Secure Solutions SiteGuard Server Edition, to its Known Exploited Vulnerabilities (KEV) catalog on October 20, 2026. The catalog update listed six additions in total. The flaw lets an attacker run arbitrary OS commands with root or SYSTEM privileges on the host running the web application firewall module.
Technical Details
| Item | Detail |
|---|---|
| Weakness | OS command injection (CWE-78) in the statistics function |
| Default state | Statistics function is enabled by default |
| Privileges gained | root (Unix) or SYSTEM (Windows) |
| CVSS v4.0 | 8.5 |
| CVSS v3.0 | 7.8 (local access, low privileges) |
| Vendor advisory | October 14, 2026 |
| Related advisories | JVN#88474777, JPCERT-AT-2026-0032 |
EG Secure Solutions says exploitation has been confirmed but has not shared attack details. It notified customers with direct support contracts on September 29, 2026. No public indicators of compromise (hashes, IPs or domains) have been reported.
Affected and Fixed Versions
| Edition | Affected | Fixed |
|---|---|---|
| Apache, Nginx, IIS (non-FreeBSD) | Before 8.00 Update 5 | 8.00 Update 5 |
| FreeBSD Apache and Nginx | Before 7.00 Update 6 | 7.00 Update 6 |
| IIS 3.10 through 4.00 Update 4 | Not affected | n/a |
Remediation
- Save diagnostics first. Reporting indicates patching may erase evidence of compromise, so capture logs, configuration and the module's working directories before updating.
- Apply the fixed version for your edition.
- Check the host for unexpected processes, scheduled tasks, new accounts and outbound connections, since compromise yields root or SYSTEM.
- Restrict who can reach the module's management and statistics functions.
- US federal agencies are subject to the KEV remediation deadline; other organizations should treat it as an equivalent priority.