CVE-2026-106931

Deferred Deferred - Pending Action

OS Command Injection in SiteGuard Server Edition

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: JPCERT/CC

Description

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106931

EUVD

EUVD-2026-100814

Affected Vendors & Products

Vendor	Product	Version / Range
EG	Secure	Solutions Inc. SiteGuard Server Edition for Apache httpd Ver2.20
EG	Secure	Solutions Inc. SiteGuard Server Edition for Nginx Ver2.20
EG	Secure	Solutions Inc. SiteGuard Server Edition for IIS Ver2.20
EG	Secure	Solutions Inc. SiteGuard Server Edition for Nginx on FreeBSD Ver2.20

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

SiteGuard Server Edition has an OS command injection vulnerability that allows attackers to execute arbitrary commands with root or SYSTEM privileges. This occurs when the statistics feature is enabled, which is the default setting. The vulnerability affects multiple versions of the software across Apache, Nginx, IIS, and FreeBSD platforms.

Detection Guidance

Check if SiteGuard Server Edition is installed and verify the version. If using IIS, confirm if the version is between Ver3.10 and Ver4.00 Update 4. Ensure the statistics feature is enabled (default setting). Monitor for unusual command execution patterns or unauthorized root/SYSTEM privilege escalations.

Impact Analysis

An attacker could exploit this to run malicious commands on your system with high privileges, potentially leading to full system compromise. This could allow unauthorized access, data theft, or disruption of services. The vulnerability is already being exploited in the wild, increasing the risk.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations could face legal penalties, fines, or reputational damage if exploited due to inadequate security measures.

Mitigation Strategies

Update SiteGuard Server Edition to Ver8.00 Update 5 (Apache/Nginx/IIS) or Ver7.00 Update 6 (FreeBSD). If updating is not possible, apply the provided patch. Before updating, download and store diagnostic information. Disable the statistics feature if not required.

Hi! I’m here to help you understand CVE-2026-106931. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70