CISA Adds Actively Exploited SiteGuard Server Edition Vulnerability to KEV
The CVE-2026-106931 vulnerability in SiteGuard Server Edition allows commands to be executed with root or SYSTEM privileges. On October 20, 2026, CISA added it to the Known Exploited Vulnerabilities catalog.
The CVE-2026-106931 vulnerability in EG Secure Solutions’ SiteGuard Server Edition was added by CISA to the Known Exploited Vulnerabilities (KEV) catalog on October 20, 2026. The vendor and Japan’s JVN/JPCERT coordination center state that the flaw has already been exploited in the wild.
It is an OS command injection in the web application firewall’s statistical function. A successful attack could allow an attacker to execute arbitrary commands with the highest operating system privileges—root on Unix systems or SYSTEM on Windows.
CVE-2026-106931 Affects a Function Enabled by Default in SiteGuard
Supported SiteGuard Server Edition versions from Ver2.20 onward are affected if the statistical function is enabled. According to the vendor, it is enabled by default. For deployments on Microsoft IIS, the exception covers versions Ver3.10 through Ver4.00 Update4, which are not affected by the stated vulnerability scope.
EG Secure Solutions released fixes in Ver8.00 Update5 for Apache httpd, Nginx, and IIS platforms. For Apache httpd and Nginx variants on FreeBSD, the Ver7.00 Update6 fix is available. The vendor also provides a separate patch, including for product versions that have reached end of support.
Administrators Advised to Preserve Diagnostic Data Before Remediation
Administrators should first identify SiteGuard Server Edition installations, verify the platform and version in use, and check the status of the statistical function. For affected systems, they should follow the vendor’s instructions and deploy the applicable update or separate patch.
The vendor also warns that updating or applying the patch may remove traces of a potential attack. It therefore recommends saving diagnostic data before remediation.
Being added to KEV means that CISA lists the vulnerability among flaws with known exploitation. According to the supplied CISA record, organizations are required to follow the vendor’s instructions and the applicable BOD 26-04 rules.
Campaign Details Have Not Yet Been Published
Publicly available information does not identify the attackers or state the number of victims, the campaign’s scope, or the specific method of initial access.
Further developments may include additional information from CISA about evidence of exploitation and any remediation deadlines. Updates from EG Secure Solutions or JPCERT/CC may also be relevant, particularly if they publish indicators of compromise, attack details, or additional mitigation procedures.
Sources
- CISA Known Exploited Vulnerabilities Catalog – The supplied primary entry lists CVE-2026-106931 in KEV and specifies the required steps under the vendor’s instructions and BOD 26-04.
- EG Secure Solutions – The vendor confirms exploitation, the scope of affected versions, available fixes, and the need to preserve diagnostic data before remediation.
- JVN / JPCERT/CC – The independent coordination advisory confirms the vulnerability, active exploitation, impact on root/SYSTEM privileges, and fixed versions.
Verified and updated: October 21, 2026 06:22
