CVE-2026-106931

Exploited in the wild. In CISA KEV since 2026‑10‑20. Fixed versions are out.

CVSS 3.07.8High EPSS percentile67th1.2% chance in 30 days CISA KEVListedsince 2026-10-20, due 2026-10-23
No public exploit known Fix5 products2 fixed builds listed below

Published 2026-10-14Updated 2026-10-21Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

EG Secure Solutions Inc. SiteGuard Server Edition for Apache httpdAffected: ≥ Ver2.20, < Ver8.00 Update 5Upgrade to: Ver8.00 Update 5Stated by: CVE record
EG Secure Solutions Inc. SiteGuard Server Edition for NginxAffected: ≥ Ver2.20, < Ver8.00 Update 5Upgrade to: Ver8.00 Update 5Stated by: CVE record
EG Secure Solutions Inc. SiteGuard Server Edition for IISAffected: ≥ Ver2.20, < Ver8.00 Update 5Upgrade to: Ver8.00 Update 5Stated by: CVE record
EG Secure Solutions Inc. SiteGuard Server Edition for Apache httpd on FreeBSDAffected: ≥ Ver2.20, < Ver7.00 Update 6Upgrade to: Ver7.00 Update 6Stated by: CVE record
EG Secure Solutions Inc. SiteGuard Server Edition for Nginx on FreeBSDAffected: ≥ Ver2.20, < Ver7.00 Update 6Upgrade to: Ver7.00 Update 6Stated by: CVE record

Versions as the sources state them. 1 more product has version data. Full version matrix after sign-in

Steps

Written by AI from the record

Check which SiteGuard Server Edition product and version you run (Apache httpd, Nginx, IIS, or the FreeBSD variants).
Confirm whether any local user accounts on that server could be used by an attacker to log in, even with low privileges.
Update SiteGuard Server Edition for Apache httpd, Nginx, or IIS to Ver8.00 Update 5.
Update SiteGuard Server Edition for Apache httpd on FreeBSD or Nginx on FreeBSD to Ver7.00 Update 6.
Restrict and audit local login access to the server until the update is applied.

Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

2 publishers

Advisory coverage
as reported · Oct 21, 2026·The Hacker News summary
Added to CISA KEV catalog
Oct 20, 2026·CISA KEV
Hackers are actively exploiting an OS command injection vulnerability in SiteGuard WAF (CVE-2026-106931) to execute commands with root privileges on affected web servers.
as reported · Oct 18, 2026·BleepingComputer summary

Sourced from public security reporting — each date is when it was published, not when it happened. 2 further articles named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

In plain language

Written by AI from the record

SiteGuard Server Edition, a web server security tool, has a flaw that lets a logged-in local user seize full administrator control of the server, and attackers are already exploiting it — if you run this product, update right away.

CWE-78 OS command injection in SiteGuard Server Edition allows a locally-authenticated low-privilege user to execute arbitrary commands as root/SYSTEM, with active exploitation confirmed by the vendor and JPCERT, reportedly tied to the Qilin actor.

If you're affected

Full server takeover
Ransomware risk
Operational disruption
Loss of server trust/integrity

What is it

SiteGuard Server Edition is software that helps protect web servers. This flaw is like a hidden backdoor inside the security guard's own office: someone who already has a basic keycard to the building can use this flaw to get the master key to everything, including systems the guard was supposed to protect.

Who is affected

This matters to you if you run SiteGuard Server Edition to protect a web server running Apache, Nginx, or IIS, including the FreeBSD-based versions. It is a risk if any user, even one with limited permissions, can log into that server locally — such as another employee, a contractor, or an attacker who got in through a separate foothold.

How urgent is it

Attackers are already exploiting this vulnerability, with abuse confirmed by both the vendor and Japan's national cybersecurity response team, and reports linking it to the Qilin ransomware actor. This is not a theoretical risk — act now rather than waiting for a routine maintenance window.

What to do — in detail

Identify your exact SiteGuard Server Edition variant and current version. Exposure is contingent on local access: any account with low-level privileges on the host (including compromised service accounts or malicious insiders) can trigger the command injection to escalate to root/SYSTEM, so review who has local login rights as an interim mitigation. Apply the vendor fix: Ver8.00 Update 5 for the Apache httpd, Nginx, and IIS editions; Ver7.00 Update 6 for the Apache httpd on FreeBSD and Nginx on FreeBSD editions. No workaround beyond restricting local account access and auditing existing sessions is documented; patching is the only complete remediation. Given confirmed active exploitation tied to the Qilin threat actor, monitor for unexpected privilege escalation events, unusual root/SYSTEM-level process execution, and new/modified local accounts on hosts running this product until patched.

Technical context

CVSS 3.0 score 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects local-vector OS command injection (CWE-78) requiring low privileges and no user interaction, resulting in complete confidentiality/integrity/availability compromise. Not currently in CISA's KEV catalog, but news reporting and vendor/JPCERT confirmation establish active in-the-wild exploitation as of 2026-10-18, reportedly associated with the Qilin actor. No public exploit code is on record. Exploit maturity should be treated as functional-in-the-wild despite absence of published PoC, given confirmed abuse.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS67th

CISA KEV

Listed as exploited in the wild since 2026-10-20.

US federal agencies must remediate by 2026-10-23.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.2% chance of exploitation activity in the next 30 days, which ranks it in the 67th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Sustained, driven by in-the-wild reports.

Lifecycle

12 events over 7 days, from the signal feeds we watch.

2026-10-21Patch availablerecord updated, record updated
2026-10-20Added to CISA KEVrecord updated
2026-10-16Record updated
2026-10-15Record updated
2026-10-14Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable