◆ CVE Hub

CVE-2026-106931

KEV: known exploited SSVC: active
Published
2026-10-14
Last modified
2026-10-21
CNA
jpcert
NVD status
Analyzed
CWE
CWE-78

Fetching some sources has been requested. Reload in about a minute to see them.

CVSS v3.1 (listed by NVD)
7.8
HIGH
Scored by jpcert.or.jp (not yet scored by NVD)
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0 (listed by NVD)
8.5
HIGH
Scored by jpcert.or.jp (not yet scored by NVD)
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS (listed by CVE.org)
8.5
HIGH
Scored by CNA (jpcert) · v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS exploit probability
1.2%
Percentile 67.2%
as of 2026-10-24
CISA KEV
Listed
Added 2026-10-20 / due 2026-10-23
Ransomware use: Unknown
SSVC (CISA ADP)
active
Automatable: no / Impact: total

Attack conditions and impact

Derived from the CNA (via NVD) CVSS 3.0 vector
LocalLoginNo interaction Confidentiality HIntegrity HAvailability H
MetricValueMeaning
Attack vector AVLLocal
Attack complexity ACLLow (easy)
Privileges required PRLRegular user
User interaction UINNone
Scope SUUnchanged
Confidentiality CHHigh
Integrity IHHigh
Availability AHHigh
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

NVD

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

CISA KEV entry

EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability — EG Secure Solutions / SiteGuard Server Edition

EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

https://www.eg-secure.co.jp/siteguard/news/alert-202610-1 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-106931

CVSS assessments

ProviderVersionScoreVector
NVD / [email protected] (Secondary)4.08.5 HIGHCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD / [email protected] (Secondary)3.07.8 HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA / jpcert3.07.8 HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA / jpcert4.08.5 HIGHCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products and packages

CNA (CVE.org)

VendorProductVersions
EG Secure Solutions Inc.SiteGuard Server Edition for Apache httpd
affected: Ver2.20 … < Ver8.00 Update 5
default: unaffected
EG Secure Solutions Inc.SiteGuard Server Edition for Nginx
affected: Ver2.20 … < Ver8.00 Update 5
default: unaffected
EG Secure Solutions Inc.SiteGuard Server Edition for IIS
affected: Ver2.20 … < Ver8.00 Update 5
default: unaffected
EG Secure Solutions Inc.SiteGuard Server Edition for Apache httpd on FreeBSD
affected: Ver2.20 … < Ver7.00 Update 6
default: unaffected
EG Secure Solutions Inc.SiteGuard Server Edition for Nginx on FreeBSD
affected: Ver2.20 … < Ver7.00 Update 6
default: unaffected

NVD CPE (27)

Show CPE list
VendorProductRangeCPE
e-guardiansiteguard>= 2.20, < 8.00cpe:2.3:a:e-guardian:siteguard:*:*:*:*:server:apache:*:*
e-guardiansiteguardcpe:2.3:a:e-guardian:siteguard:8.00:-:*:*:server:apache:*:*
e-guardiansiteguardcpe:2.3:a:e-guardian:siteguard:8.00:update1:*:*:server:apache:*:*
e-guardiansiteguardcpe:2.3:a:e-guardian:siteguard:8.00:update2:*:*:server:apache:*:*
e-guardiansiteguardcpe:2.3:a:e-guardian:siteguard:8.00:update3:*:*:server:apache:*:*
e-guardiansiteguard>= 2.20, < 7.00cpe:2.3:a:e-guardian:siteguard:*:*:*:*:server:apache:*:*
e-guardiansiteguardcpe:2.3:a:e-guardian:siteguard:7.00:-:*:*:server:apache:*:*
e-guardiansiteguardcpe:2.3:a:e-guardian:siteguard:7.00:update1:*:*:server:apache:*:*
e-guardiansiteguardcpe:2.3:a:e-guardian:siteguard:7.00:update2:*:*:server:apache:*:*
e-guardiansiteguardcpe:2.3:a:e-guardian:siteguard:7.00:update3:*:*:server:apache:*:*
e-guardiansiteguardcpe:2.3:a:e-guardian:siteguard:7.00:update4:*:*:server:apache:*:*
e-guardiansiteguardcpe:2.3:a:e-guardian:siteguard:7.00:update5:*:*:server:apache:*:*
e-guardiansiteguard>= 2.20, < 8.00cpe:2.3:a:e-guardian:siteguard:*:*:*:*:server:nginx:*:*
e-guardiansiteguardcpe:2.3:a:e-guardian:siteguard:8.00:-:*:*:server:nginx:*:*
e-guardiansiteguardcpe:2.3:a:e-guardian:siteguard:8.00:update1:*:*:server:nginx:*:*
e-guardiansiteguardcpe:2.3:a:e-guardian:siteguard:8.00:update2:*:*:server:nginx:*:*
e-guardiansiteguardcpe:2.3:a:e-guardian:siteguard:8.00:update3:*:*:server:nginx:*:*
e-guardiansiteguard>= 2.20, < 7.00cpe:2.3:a:e-guardian:siteguard:*:*:*:*:server:nginx:*:*
e-guardiansiteguardcpe:2.3:a:e-guardian:siteguard:7.00:-:*:*:server:nginx:*:*
e-guardiansiteguardcpe:2.3:a:e-guardian:siteguard:7.00:update1:*:*:server:nginx:*:*
e-guardiansiteguardcpe:2.3:a:e-guardian:siteguard:7.00:update2:*:*:server:nginx:*:*
e-guardiansiteguardcpe:2.3:a:e-guardian:siteguard:7.00:update3:*:*:server:nginx:*:*
e-guardiansiteguardcpe:2.3:a:e-guardian:siteguard:7.00:update4:*:*:server:nginx:*:*
e-guardiansiteguardcpe:2.3:a:e-guardian:siteguard:7.00:update5:*:*:server:nginx:*:*
e-guardiansiteguard>= 2.20, < 3.10cpe:2.3:a:e-guardian:siteguard:*:*:*:*:server:internet_information_services:*:*
e-guardiansiteguard>= 4.10, < 8.00cpe:2.3:a:e-guardian:siteguard:*:*:*:*:server:internet_information_services:*:*
e-guardiansiteguardcpe:2.3:a:e-guardian:siteguard:8.00:update4:*:*:server:internet_information_services:*:*

Linux distribution status

Red Hat ↗ Fetching

Debian ↗

No record

Ubuntu ↗ Fetching

References (3)