Vulnerability details
CVE-2026-106931
Actively exploited
EG Secure Solutions SiteGuard for Apache httpdEG Secure Solutions SiteGuard for Apache httpd on FreeBSDEG Secure Solutions SiteGuard for IISEG Secure Solutions SiteGuard for NginxEG Secure Solutions SiteGuard for Nginx on FreeBSD
CVSS 4.0
8.5High
Official description
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.5High | 4.0 | CVEProject cvelistV5 (CNA) (jpcert) | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 7.8High | 3.0 | CVEProject cvelistV5 (CNA) (jpcert) | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| EG Secure Solutions Inc. | SiteGuard Server Edition for Apache httpd | Ver2.20 ≤ v < Ver8.00 Update 5 | CVEProject cvelistV5 (CNA) |
| EG Secure Solutions Inc. | SiteGuard Server Edition for Apache httpd on FreeBSD | Ver2.20 ≤ v < Ver7.00 Update 6 | CVEProject cvelistV5 (CNA) |
| EG Secure Solutions Inc. | SiteGuard Server Edition for IIS | Ver2.20 ≤ v < Ver8.00 Update 5 | CVEProject cvelistV5 (CNA) |
| EG Secure Solutions Inc. | SiteGuard Server Edition for Nginx | Ver2.20 ≤ v < Ver8.00 Update 5 | CVEProject cvelistV5 (CNA) |
| EG Secure Solutions Inc. | SiteGuard Server Edition for Nginx on FreeBSD | Ver2.20 ≤ v < Ver7.00 Update 6 | CVEProject cvelistV5 (CNA) |
References and advisories
3
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-14
- Last updated
- 2026-10-21
- State
- Published
- Assigner (CNA)
- jpcert
- Kolun priority
- 74 · High
CISA KEV catalog
- Date added
- 2026-10-20
- Due date
- 2026-10-23
- Used in ransomware
- Unknown
Exploit prediction (EPSS)
2.52%
Probability of exploitation in 30 days
84.9%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Active
- Technical impact
- Total
Weaknesses (CWE)
- CWE-78Improper neutralization of special elements used in an OS command ('OS Command Injection')