---
id: CVE-2026-106931
title: >-
  SiteGuard Server Edition contains an OS command injection vulnerability, which
  may allow an attacker to execute arbitrary OS commands with root or SYSTEM
  privileges on the system running the affected product.
summary: >-
  SiteGuard Server Edition contains an OS command injection vulnerability, which
  may allow an attacker to execute arbitrary OS commands with root or SYSTEM
  privileges on the system running the affected product.
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T10:17:51.403'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-106931'
references:
  - url: 'https://jvn.jp/en/jp/JVN88474777/'
    label: vultures@jpcert.or.jp
  - url: 'https://www.eg-secure.co.jp/siteguard/news/alert-202610-1'
    label: vultures@jpcert.or.jp
tags:
  - nvd
  - cve.org
  - in-the-wild
  - exploit-available
  - kev
ingestedAt: '2026-10-14T06:17:13.780Z'
vendor: EG Secure Solutions Inc.
product: SiteGuard Server Edition for Apache httpd
affected:
  - siteguard_server_edition_for_apache_httpd >= Ver2.20 < Ver8.00 Update 5
  - siteguard_server_edition_for_nginx >= Ver2.20 < Ver8.00 Update 5
  - siteguard_server_edition_for_iis >= Ver2.20 < Ver8.00 Update 5
  - >-
    siteguard_server_edition_for_apache_httpd_on_freebsd >= Ver2.20 < Ver7.00
    Update 6
  - siteguard_server_edition_for_nginx_on_freebsd >= Ver2.20 < Ver7.00 Update 6
ssvc:
  exploitation: active
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-20T19:46:31.419792Z'
epss: 0.02528
epssPercentile: 0.84811
exploited: true
exploitAvailable: true
kev: true
kevDateAdded: '2026-10-20'
kevDueDate: '2026-10-23'
kevRansomware: false
---

## Overview

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.