CVE-2026-106931
published 2026-10-14CVE-2026-106931: SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM…
PriorityP183high8.5CVSS 4.0
AVLACLATNPRLUINVCHVIHVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
KEVITW
CISA Known Exploited Vulnerabilitydue 2026-10-23
Exploited in the wild
EPSS
2.53%
84.8th percentile
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| e-guardian | siteguard | — | — |
| e-guardian | siteguard | — | — |
| e-guardian | siteguard | — | — |
| e-guardian | siteguard | — | — |
| e-guardian | siteguard | — | — |
| e-guardian | siteguard | — | — |
| e-guardian | siteguard | — | — |
| e-guardian | siteguard | — | — |
| e-guardian | siteguard | — | — |
| e-guardian | siteguard | — | — |
| e-guardian | siteguard | — | — |
| e-guardian | siteguard | >= 2.20 < 8.00 | 8.00 |
| e-guardian | siteguard | >= 2.20 < 7.00 | 7.00 |
| e-guardian | siteguard | >= 2.20 < 3.10 | 3.10 |
| e-guardian | siteguard | >= 4.10 < 8.00 | 8.00 |
| eg_secure_solutions_inc | siteguard_server_edition_for_apache_httpd | >= Ver2.20 < Ver8.00 Update 5 | Ver8.00 Update 5 |
| eg_secure_solutions_inc | siteguard_server_edition_for_apache_httpd_on_freebsd | >= Ver2.20 < Ver7.00 Update 6 | Ver7.00 Update 6 |
| eg_secure_solutions_inc | siteguard_server_edition_for_iis | >= Ver2.20 < Ver8.00 Update 5 | Ver8.00 Update 5 |
| eg_secure_solutions_inc | siteguard_server_edition_for_nginx | >= Ver2.20 < Ver8.00 Update 5 | Ver8.00 Update 5 |
| eg_secure_solutions_inc | siteguard_server_edition_for_nginx_on_freebsd | >= Ver2.20 < Ver7.00 Update 6 | Ver7.00 Update 6 |
CVSS provenance
nvdv4.08.5HIGHCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vulncheck8.5HIGH
cisa8.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
EG Secure Solutions SiteGuard Server Edition for Apache httpd os command injection
vuldb·2026-10-20·CVSS 8.5
CVE-2026-106931 [HIGH] EG Secure Solutions SiteGuard Server Edition for Apache httpd os command injection
A vulnerability marked as critical has been reported in EG Secure Solutions SiteGuard Server Edition for Apache httpd, SiteGuard Server Edition for FreeBSD, SiteGuard Server Edition for IIS, SiteGuard Server Edition for Nginx and SiteGuard Server Edition for Nginx on FreeBSD. The affected element is an unknown function. Performing a manipulation results in os command injection.
This vulnerability was named CVE-2026-106931. The attack may be initiated remotely. In addition, an exploit is available.
GHSA
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected
ghsa_unreviewed·2026-10-14
CVE-2026-106931 [HIGH] CWE-78 SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
VulnCheck
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
vulncheck·2026·CVSS 8.5
CVE-2026-106931 [HIGH] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.eg-secure.co.jp/siteguard/news/alert-202610-1
CISA
EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
cisa·2026-10-20·CVSS 8.5
CVE-2026-106931 [HIGH] CWE-78 EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
Vulnerability: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
Affected: EG Secure Solutions SiteGuard Server Edition
EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating ea
No detection rules found.
No public exploits indexed.
Hackernews
CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
blogs_hackernews·2026-10-21·CVSS 8.5
CVE-2026-96652 [HIGH] CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities ( KEV ) catalog, including four vulnerabilities impacting Plex Media Server that's collectively called Plex2Shell .
The vulnerabilities are listed below -
CVE-2026-96652 (CVSS score: 5.3) - Plex Media Server Server-Side Request Forgery (SSRF) vulnerability
CVE-2026-96654 (CVSS score: 6.9) - Plex Media Server improper neutralization of encoded URI schemes in a web page Vulnerability
CVE-2026-9665
Hackernews
ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More
blogs_hackernews·2026-10-16·CVSS 9.1
CVE-2026-0257 [CRITICAL] ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More
Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And somehow, it fits right in with this week's security stories.
The rest gets interesting in different ways. A small permission can lead to a big theft. A trusted login can hide the wrong person. Old bugs are finding new victims, familiar tools are being put to strange uses, and some flaws are so simple you wonder how nobody spotted them sooner.
There's a lot more hiding in the details, including a few twists you
2026-10-14
Published
2026-10-20
Added to CISA KEV
Exploited in the wild