SiteGuard Server Edition command injection CVE-2026-106931 exploited; fixes available
Attackers are exploiting SiteGuard Server Edition’s statistics feature to run commands with full server privileges. Website operators should preserve diagnostic information, then install the fixed version or vendor patch.
If you operate a website, ask its administrator or hosting provider whether it uses SiteGuard Server Edition. Before updating, they should download and retain diagnostic information from SiteGuard’s web management screen and investigate possible compromise. Install Ver8.00 Update 5 for Apache httpd, Nginx or IIS, or Ver7.00 Update 6 for Apache httpd or Nginx on FreeBSD; ask vendor support for the replacement-file patch if upgrading is difficult.
What’s happening
EG Secure Solutions’ SiteGuard Server Edition, security software installed on web servers, has a command injection flaw in its statistics feature. Exploitation can give an attacker root or Windows SYSTEM privileges. The vendor’s assessment describes an attack requiring local access with limited privileges. Affected installations have statistics enabled, which is the default. EG Secure Solutions notified direct-support customers on 29 September and publicly confirmed exploitation on 14 October; CISA listed the flaw on 20 October. Fixes cover all affected editions, with separate replacement-file patches available even for unsupported versions. Administrators should preserve diagnostic information before patching because the change may erase attack traces. As at 3 November, the reviewed advisories do not identify the attackers, victims or scale of exploitation.
- What
- Flaw
- Affects
- EG Secure Solutions SiteGuard Server Edition
- Affected
- SiteGuard Server Edition for Apache httpd: Ver2.20 and later, before Ver8.00 Update 5, with statistics enabled
SiteGuard Server Edition for Nginx: Ver2.20 and later, before Ver8.00 Update 5, with statistics enabled
SiteGuard Server Edition for IIS: Ver2.20 and later, before Ver8.00 Update 5, with statistics enabled; Ver3.10 through Ver4.00 Update 4 are unaffected
SiteGuard Server Edition for Apache httpd on FreeBSD: Ver2.20 and later, before Ver7.00 Update 6, with statistics enabled
SiteGuard Server Edition for Nginx on FreeBSD: Ver2.20 and later, before Ver7.00 Update 6, with statistics enabled - Fixed in
- SiteGuard Server Edition for Apache httpd: Ver8.00 Update 5
SiteGuard Server Edition for Nginx: Ver8.00 Update 5
SiteGuard Server Edition for IIS: Ver8.00 Update 5
SiteGuard Server Edition for Apache httpd on FreeBSD: Ver7.00 Update 6
SiteGuard Server Edition for Nginx on FreeBSD: Ver7.00 Update 6 - Since
- 20 Oct 2026
- Closed
- 20 Oct 2026
Timeline
- CISA added
CISA added CVE-2026-106931 to its Known Exploited Vulnerabilities catalogue, as recorded in its contribution to the official CVE record.
- Update
JPCERT/CC urged affected operators to consider investigating for compromise. It warned that updates could remove attack traces and recommended preserving SiteGuard diagnostic information first.
- Made publicFixed
EG Secure Solutions publicly disclosed CVE-2026-106931 and confirmed exploitation. It listed fixes in Ver8.00 Update 5 for Apache httpd, Nginx and IIS, and Ver7.00 Update 6 for Apache httpd and Nginx on FreeBSD.
- Update
EG Secure Solutions privately notified customers with direct support contracts about the vulnerability and available upgrade and individual-patch options.
Sources
- SiteGuard Server Edition OS command injection vulnerability — emergency noticeEG Secure Solutions · 14 Oct 2026
- JVN#88474777: SiteGuard Server Edition vulnerable to OS command injectionJPCERT/CC and IPA · 14 Oct 2026
- JPCERT-AT-2026-0032: SiteGuard Server Edition vulnerability CVE-2026-106931JPCERT/CC · 14 Oct 2026
- CVE-2026-106931 official record, including CISA exploitation assessmentCVE Program / JPCERT/CC / CISA · 21 Oct 2026