Is CVE-2026-106931 exploited in the wild?

Yes. CVE-2026-106931 is known to be exploited in the wild, first recorded on 20 October 2026. Treat it as urgent.

How severe is CVE-2026-106931?

Critical severity, with a CVSS score of 7.8, published 14 October 2026.

Which products and versions are affected?

EG Secure Solutions SiteGuard Server Edition Ver2.20 through Ver8.00 Update 4 (Apache, Nginx, IIS); Ver2.20 through Ver7.00 Update 5 (FreeBSD Apache, Nginx); excluding IIS Ver3.10–Ver4.00 Update 4.

How is CVE-2026-106931 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-106931?

Check whether you run EG Secure Solutions SiteGuard Server Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106931: EG Secure Solutions SiteGuard Server Edition OS command injection

CVE-2026-106931 · Severity: critical · CVSS 7.8 · Exploited in the wild · Published 2026-10-14

SiteGuard Server Edition is a host-based Web Application Firewall that protects web servers from attacks. A vulnerability in its statistics feature allows an authenticated attacker to execute arbitrary operating system commands with root or SYSTEM privileges, potentially giving an attacker complete control of the web server. The vulnerability is enabled by default and has been exploited in the wild.

Quick answers

Is CVE-2026-106931 exploited in the wild?: Yes. CVE-2026-106931 is known to be exploited in the wild, first recorded on 20 October 2026. Treat it as urgent.
How severe is CVE-2026-106931?: Critical severity, with a CVSS score of 7.8, published 14 October 2026.
Which products and versions are affected?: EG Secure Solutions SiteGuard Server Edition Ver2.20 through Ver8.00 Update 4 (Apache, Nginx, IIS); Ver2.20 through Ver7.00 Update 5 (FreeBSD Apache, Nginx); excluding IIS Ver3.10–Ver4.00 Update 4.
Is there a fix for CVE-2026-106931?: Yes: fixed in SiteGuard Server Edition Ver8.00 Update 5 (Apache, Nginx, IIS); Ver7.00 Update 6 (FreeBSD Apache, Nginx). Until then: For customers unable to upgrade, the vendor provides a patch that replaces the files used in statistical processing, available for both current and end-of-life versions. Before applying patches or upgrades, download and preserve diagnostic information from the web management interface as attack traces may be cleared after remediation. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106931 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-106931?: Check whether you run EG Secure Solutions SiteGuard Server Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: SiteGuard Server Edition Ver8.00 Update 5 (Apache, Nginx, IIS); Ver7.00 Update 6 (FreeBSD Apache, Nginx)

For customers unable to upgrade, the vendor provides a patch that replaces the files used in statistical processing, available for both current and end-of-life versions. Before applying patches or upgrades, download and preserve diagnostic information from the web management interface as attack traces may be cleared after remediation.

Technical details

The statistics feature in SiteGuard Server Edition contains an OS command injection vulnerability (CWE-78) that allows an authenticated local attacker to execute arbitrary OS commands with elevated privileges. The vulnerability requires local access and low-level user privileges to exploit; it is active by default in affected versions. Successful exploitation grants attackers root or SYSTEM-level code execution on the web server running the product.

Affected products

EG Secure Solutions SiteGuard Server Edition Ver2.20 through Ver8.00 Update 4 (Apache, Nginx, IIS); Ver2.20 through Ver7.00 Update 5 (FreeBSD Apache, Nginx); excluding IIS Ver3.10–Ver4.00 Update 4

Timeline

2026-10-14: disclosed
2026-10-14: exploited: Confirmed exploitation in the wild

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.