Key points
- CVE-2026-106931 allows OS command injection with root or SYSTEM privileges in SiteGuard Server Edition.
- The flaw affects the statistics feature, which is enabled by default on versions 2.20 and later.
- EG Secure Solutions provides a file-replacement patch for systems that cannot upgrade to the latest version.
EG Secure Solutions SiteGuard Server Edition contains a high-severity OS command injection vulnerability tracked as CVE-2026-106931. The flaw affects version 2.20 and later when the statistics feature is enabled. Attackers can execute arbitrary commands with root or SYSTEM privileges. A fix is available via vendor patches or version upgrades.
In plain English
This bug lives in the statistics processing function of the web application firewall. Because that feature turns on by default, most installations are exposed. An attacker who gains local access with low privileges can use this flaw to run system commands. Those commands execute with the highest possible permissions on the server, effectively handing over full control of the machine.
The background
Security Affairs reports that threat actors are already exploiting CVE-2026-106931 in the wild. The vendor issued an urgent alert and notified direct support customers on September 29, 2026. Japan’s vulnerability coordination service published its advisory on October 14, 2026. The National Vulnerability Database assigns it a CVSS 4.0 score of 8.5, classifying it as high severity.
What changes now
Administrators must determine if their systems run affected versions. For Apache, Nginx, and IIS outside FreeBSD, any release before 8.00 Update 5 is at risk. FreeBSD installations using Apache or Nginx require version 7.00 Update 6 or later. IIS editions from version 3.10 through 4.00 Update 4 are not affected. The vendor offers a patch that replaces specific files for those who cannot upgrade.
Who needs to act first
Teams should prioritize systems that face the internet or handle sensitive data. Check whether the statistics feature is active on your servers. If you cannot upgrade immediately, apply the vendor-supplied file patch to reduce exposure. Back up diagnostic information before making changes, as updates may erase signs of prior intrusion. Test the fix in a non-production environment first to ensure stability before rolling it out broadly.
Background: CVSS 4.0
CVSS 4.0 is the latest standard for rating software vulnerabilities. It moves beyond simple severity scores by measuring the actual impact on your systems. You learn how attackers exploit flaws and what defenses you need. This helps you prioritize fixes based on real risk, not just theoretical danger, saving time and resources.
Read the full guide: CVSS 4.0 Explained: How to Measure Software Risk Accurately
What to do and how to stay safe: SiteGuard Server Edition
- Verify your SiteGuard Server Edition version and platform against the affected lists to confirm exposure.
- Download and save diagnostic information from the web management screen before applying any updates or patches.
- Apply the vendor-provided patch or upgrade to the specified safe versions to eliminate the command injection risk.
- Monitor system logs for unusual activity that might indicate prior exploitation before the fix was installed.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this vulnerability allow remote attacks without authentication?
No, the severity ratings indicate a local attack requiring low privileges and no user interaction is needed.
Are all versions of SiteGuard Server Edition affected?
Only version 2.20 and later with the statistics feature enabled are affected, with specific exceptions for certain IIS versions.
What happens if I patch without saving diagnostics first?
The vendor warns that updating may erase traces of an attack, making it harder to prove if the server was compromised.
