{"id":"siteguard-server-command-injection-oct-2026","category":"patch","status":"closed","title":"SiteGuard Server Edition command injection CVE-2026-106931 exploited; fixes available","tldr":"Attackers are exploiting SiteGuard Server Edition’s statistics feature to run commands with full server privileges. Website operators should preserve diagnostic information, then install the fixed version or vendor patch.","summary":"EG Secure Solutions’ SiteGuard Server Edition, security software installed on web servers, has a command injection flaw in its statistics feature. Exploitation can give an attacker root or Windows SYSTEM privileges. The vendor’s assessment describes an attack requiring local access with limited privileges. Affected installations have statistics enabled, which is the default. EG Secure Solutions notified direct-support customers on 29 September and publicly confirmed exploitation on 14 October; CISA listed the flaw on 20 October. Fixes cover all affected editions, with separate replacement-file patches available even for unsupported versions. Administrators should preserve diagnostic information before patching because the change may erase attack traces. As at 3 November, the reviewed advisories do not identify the attackers, victims or scale of exploitation.","action":"If you operate a website, ask its administrator or hosting provider whether it uses SiteGuard Server Edition. Before updating, they should download and retain diagnostic information from SiteGuard’s web management screen and investigate possible compromise. Install Ver8.00 Update 5 for Apache httpd, Nginx or IIS, or Ver7.00 Update 6 for Apache httpd or Nginx on FreeBSD; ask vendor support for the replacement-file patch if upgrading is difficult.","product":"EG Secure Solutions SiteGuard Server Edition","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-106931"],"tags":["eg-secure-solutions","siteguard","web-server","command-injection","actively-exploited"],"affected":["SiteGuard Server Edition for Apache httpd: Ver2.20 and later, before Ver8.00 Update 5, with statistics enabled","SiteGuard Server Edition for Nginx: Ver2.20 and later, before Ver8.00 Update 5, with statistics enabled","SiteGuard Server Edition for IIS: Ver2.20 and later, before Ver8.00 Update 5, with statistics enabled; Ver3.10 through Ver4.00 Update 4 are unaffected","SiteGuard Server Edition for Apache httpd on FreeBSD: Ver2.20 and later, before Ver7.00 Update 6, with statistics enabled","SiteGuard Server Edition for Nginx on FreeBSD: Ver2.20 and later, before Ver7.00 Update 6, with statistics enabled"],"fixed":["SiteGuard Server Edition for Apache httpd: Ver8.00 Update 5","SiteGuard Server Edition for Nginx: Ver8.00 Update 5","SiteGuard Server Edition for IIS: Ver8.00 Update 5","SiteGuard Server Edition for Apache httpd on FreeBSD: Ver7.00 Update 6","SiteGuard Server Edition for Nginx on FreeBSD: Ver7.00 Update 6"],"matches":[],"sources":[{"kind":"advisory","title":"SiteGuard Server Edition OS command injection vulnerability — emergency notice","url":"https://www.eg-secure.co.jp/siteguard/news/alert-202610-1","by":"EG Secure Solutions","date":"2026-10-14"},{"kind":"advisory","title":"JVN#88474777: SiteGuard Server Edition vulnerable to OS command injection","url":"https://jvn.jp/en/jp/JVN88474777/","by":"JPCERT/CC and IPA","date":"2026-10-14"},{"kind":"advisory","title":"JPCERT-AT-2026-0032: SiteGuard Server Edition vulnerability CVE-2026-106931","url":"https://www.jpcert.or.jp/at/2026/at260032.html","by":"JPCERT/CC","date":"2026-10-14"},{"kind":"advisory","title":"CVE-2026-106931 official record, including CISA exploitation assessment","url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/106xxx/CVE-2026-106931.json","by":"CVE Program / JPCERT/CC / CISA","date":"2026-10-21"}],"started":"2026-10-20","closed":"2026-10-20","created":"2026-11-03T22:08:49.964Z","updated":"2026-11-03T22:08:49.964Z","cve_notes":[{"cve":"CVE-2026-106931","name":"Command injection in SiteGuard’s statistics feature","what":"A command injection flaw in SiteGuard Server Edition’s enabled statistics feature can let an attacker with limited local privileges run operating-system commands as root or SYSTEM.","severity":"high","cvss":8.5}],"timeline":[{"at":"2026-10-20","added":"2026-11-03T22:00:26.134Z","kind":"cisa-added","text":"CISA added CVE-2026-106931 to its Known Exploited Vulnerabilities catalogue, as recorded in its contribution to the official CVE record.","url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/106xxx/CVE-2026-106931.json","by":"CVE Program / CISA","patch":null},{"at":"2026-10-14","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"JPCERT/CC urged affected operators to consider investigating for compromise. It warned that updates could remove attack traces and recommended preserving SiteGuard diagnostic information first.","url":"https://www.jpcert.or.jp/at/2026/at260032.html","by":"JPCERT/CC","patch":null},{"at":"2026-10-14","added":"2026-11-03T22:00:26.134Z","kind":"disclosed","text":"EG Secure Solutions publicly disclosed CVE-2026-106931 and confirmed exploitation. It listed fixes in Ver8.00 Update 5 for Apache httpd, Nginx and IIS, and Ver7.00 Update 6 for Apache httpd and Nginx on FreeBSD.","url":"https://www.eg-secure.co.jp/siteguard/news/alert-202610-1","by":"EG Secure Solutions","patch":"patched"},{"at":"2026-09-29","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"EG Secure Solutions privately notified customers with direct support contracts about the vulnerability and available upgrade and individual-patch options.","url":"https://www.eg-secure.co.jp/siteguard/news/alert-202610-1","by":"EG Secure Solutions","patch":null}],"url":"https://hard.fyi/live/siteguard-server-command-injection-oct-2026/","json":"https://hard.fyi/api/live?id=siteguard-server-command-injection-oct-2026"}