CVE-2026-106931
EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
CISA due Oct 23, 2026
- EG Secure Solutions SiteGuard Server Edition
- High
- CVSS 8.5
- EPSS 1.17%
- Fixed version listed
What to do
Fixed version listed
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.
- CISA deadline for US federal agencies
- Oct 23, 2026
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| EG Secure Solutions Inc. SiteGuard Server Edition for Apache httpd | from Ver2.20, before Ver8.00 Update 5 | Ver8.00 Update 5 |
| EG Secure Solutions Inc. SiteGuard Server Edition for Nginx | from Ver2.20, before Ver8.00 Update 5 | Ver8.00 Update 5 |
| EG Secure Solutions Inc. SiteGuard Server Edition for IIS | Only in the CVE record | Ver3.10, Ver8.00 Update 5 |
| EG Secure Solutions Inc. SiteGuard Server Edition for Apache httpd on FreeBSD | from Ver2.20, before Ver7.00 Update 6 | Ver7.00 Update 6 |
| EG Secure Solutions Inc. SiteGuard Server Edition for Nginx on FreeBSD | from Ver2.20, before Ver7.00 Update 6 | Ver7.00 Update 6 |
The CVE record lists 1 range this page cannot state exactly.
Scores and signals
- Exploitation
- Exploited in the wild
- Severity
- High, CVSS 8.5 (v4.0, scored by jpcert)
- EPSS
- 1.17% chance of exploitation in the next 30 days (EPSS from FIRST, as of Oct 24, 2026)
- CISA's SSVC decision points
- Exploitation: active. Automatable: no. Technical impact: total. As of Oct 20, 2026.
- Weakness
- CWE-78: Improper neutralization of special elements used in an OS command ('OS Command Injection')
- Vendor
- EG Secure Solutions, SiteGuard Server Edition
Timeline
- Added to CISA's Known Exploited Vulnerabilities catalog: exploited in the wild. US federal agencies must remediate by 2026-10-23.