CISA added CVE-2026-106931 to its Known Exploited Vulnerabilities catalog on 2026-10-20 after confirming active exploitation of an OS command injection flaw in SiteGuard Server Edition that can lead to root or SYSTEM-level command execution.
What Is It
CVE-2026-106931 is an OS command injection vulnerability (CWE-78) in EG Secure Solutions SiteGuard Server Edition. According to NVD, it "may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product." JPCERT/CC reported the issue, and NVD published it on 2026-10-14. NVD lists its analysis status as "Deferred."
JPCERT/CC scored it as follows:
- CVSS 3.0: 7.8 (HIGH), AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 4.0: 8.5 (HIGH)
Both vectors describe a local attack that needs only low privileges and no user interaction.
Why It Matters
KEV confirms active exploitation. CISA's SSVC assessment rates exploitation as "active," technical impact as "total," and automatable as "no." NVD says a successful attack may allow the attacker to execute commands with root or SYSTEM privileges, which would amount to full control of the host. Whether ransomware campaigns use this flaw is listed as "Unknown."
CISA has flagged this entry for forensic triage. Under the BOD 26-04 forensic triage requirements, affected systems are to be reviewed for signs of compromise in addition to being remediated. The KEV due date is 2026-10-23, only three days after the vulnerability was added.
What's Vulnerable
These are the affected SiteGuard Server Edition products and versions, per the JPCERT/CC data in NVD:
- For Apache httpd: Ver2.20 up to, but not including, Ver8.00 Update 5
- For Nginx: Ver2.20 up to, but not including, Ver8.00 Update 5
- For IIS: Ver2.20 up to, but not including, Ver3.10, and Ver4.00 Update 5 up to, but not including, Ver8.00 Update 5. Versions from Ver3.10 up to Ver4.00 Update 5 are listed as unaffected.
- For Apache httpd on FreeBSD: Ver2.20 up to, but not including, Ver7.00 Update 6
- For Nginx on FreeBSD: Ver2.20 up to, but not including, Ver7.00 Update 6
Patch Status
The affected ranges end at Ver8.00 Update 5 (Apache httpd, Nginx, IIS) and Ver7.00 Update 6 (FreeBSD editions). EG Secure Solutions has published an advisory, linked below.
CISA's required action is to apply mitigations according to the vendor's instructions and to comply with BOD 26-04, "Prioritizing Security Updates Based on Risk," and CISA's "Forensics Triage Requirements." If no mitigations are available, organizations should follow the applicable BOD 26-04 guidance for cloud services or stop using the product. Stakeholders are responsible for evaluating each asset's internet exposure and following BOD 26-04 patching guidelines. Federal agencies must act by 2026-10-23.