EG Secure SiteGuard Server Edition: OS command injection
Deadline for US federal agencies: 23 Oct 2026
Summary
SiteGuard Server Edition, a host-based web application firewall that runs inside Apache httpd, Nginx or IIS, contains an OS command injection flaw in its statistics feature. An attacker with local access and low privileges can execute arbitrary OS commands with root or SYSTEM privileges on the server. The statistics feature is enabled by default, so default installations are affected, and the vendor and CISA confirm active exploitation.
Affected
- SiteGuard Server Edition Ver2.20 and later for Apache httpd, Nginx and IIS before Ver8.00 Update 5
- SiteGuard Server Edition Ver2.20 and later for Apache httpd and Nginx on FreeBSD before Ver7.00 Update 6
- Only when the statistics feature is enabled (enabled by default)
- IIS Ver3.10 to Ver4.00 Update 4 are not affected
Fixed in
- Apache httpd, Nginx and IIS: Ver8.00 Update 5
- Apache httpd and Nginx on FreeBSD: Ver7.00 Update 6
Workaround
- Patch for installations that cannot be upgraded: the vendor provides a patch that replaces the files used in statistics processing, including for end-of-life versions
- Disabling the statistics feature may reduce exposure; confirm this with the vendor before relying on it
Exploitation
- Exploited in the wild, as confirmed by the vendor and JVN
- Listed in the CISA Known Exploited Vulnerabilities catalog (added 2026-10-20)
- Public proof of concept: Unknown.
Our recommendation
- Check whether SiteGuard Server Edition is installed, including by hosting providers or agencies, and record the version and statistics setting
- Preserve diagnostic logs before patching, as remediation may erase attack traces
- Update to the fixed versions or apply the vendor patch without delay
- Review logs from late September 2026 onward for shells or download tools started by the WAF or web server process
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- JVN#88474777: SiteGuard Server Edition vulnerable to OS command injection jvn.jp
- EG Secure Solutions: SiteGuard Server Edition OS command injection alert (Japanese) www.eg-secure.co.jp
- CISA Known Exploited Vulnerabilities Catalog: CVE-2026-106931 www.cisa.gov
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:42.
Original description (NVD)
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
Required action (CISA)
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.