CVE-2026-106931
Received
Received - Intake
OS Command Injection in SiteGuard Server Edition
Vulnerability report for CVE-2026-106931, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-14
Last updated on: 2026-10-14
Assigner: JPCERT/CC
Description
Description
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| EG | Secure | Solutions Inc. SiteGuard Server Edition for Apache httpd Ver2.20 |
| EG | Secure | Solutions Inc. SiteGuard Server Edition for Nginx Ver2.20 |
| EG | Secure | Solutions Inc. SiteGuard Server Edition for IIS Ver2.20 |
| EG | Secure | Solutions Inc. SiteGuard Server Edition for Nginx on FreeBSD Ver2.20 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
