CVE Details

CVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
Published: 2026-10-20 CVSS: 7.8 HIGH Product: EG Secure Solutions SiteGuard Server Edition Due Date: 2026-10-23

EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

GitHub PoC

Warning: GitHub PoC repositories are unverified. Some may be fake or contain malware. Use caution and review code before running anything.

No GitHub PoC data.

FIRST EPSS

EPSS estimates the probability of exploitation in the next 30 days. Higher values indicate higher likelihood of real-world exploitation.

Timeline

CVE Stalker KEV MITRE GitHub FIRST (EPSS)

MITRE

CVSS

  • Score: 7.8
  • Severity: HIGH
  • Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

  • Exploitation: active
  • Automatable: no
  • Technical Impact: total

References

Show Raw Data
Key Remaining Key Value
dataType CVE_RECORD
dataVersion 5.2
cveMetadata > cveId CVE-2026-106931
cveMetadata > assignerOrgId ede6fdc4-6654-4307-a26d-3331c018e2ce
cveMetadata > state PUBLISHED
cveMetadata > assignerShortName jpcert
cveMetadata > dateReserved 2026-10-07T04:50:26.138Z
cveMetadata > datePublished 2026-10-14T04:45:07.678Z
cveMetadata > dateUpdated 2026-10-20T19:58:23.590Z
containers > cna > affected > 0 > vendor EG Secure Solutions Inc.
containers > cna > affected > 0 > product SiteGuard Server Edition for Apache httpd
containers > cna > affected > 0 > defaultStatus unaffected
containers > cna > affected > 0 > versions > 0 > version Ver2.20
containers > cna > affected > 0 > versions > 0 > status affected
containers > cna > affected > 0 > versions > 0 > versionType semver
containers > cna > affected > 0 > versions > 0 > lessThan Ver8.00 Update 5
containers > cna > affected > 1 > vendor EG Secure Solutions Inc.
containers > cna > affected > 1 > product SiteGuard Server Edition for Nginx
containers > cna > affected > 1 > defaultStatus unaffected
containers > cna > affected > 1 > versions > 0 > version Ver2.20
containers > cna > affected > 1 > versions > 0 > status affected
containers > cna > affected > 1 > versions > 0 > versionType semver
containers > cna > affected > 1 > versions > 0 > lessThan Ver8.00 Update 5
containers > cna > affected > 2 > vendor EG Secure Solutions Inc.
containers > cna > affected > 2 > product SiteGuard Server Edition for IIS
containers > cna > affected > 2 > defaultStatus unaffected
containers > cna > affected > 2 > versions > 0 > version Ver2.20
containers > cna > affected > 2 > versions > 0 > status affected
containers > cna > affected > 2 > versions > 0 > versionType semver
containers > cna > affected > 2 > versions > 0 > lessThan Ver8.00 Update 5
containers > cna > affected > 2 > versions > 0 > changes > 0 > at Ver3.10
containers > cna > affected > 2 > versions > 0 > changes > 0 > status unaffected
containers > cna > affected > 2 > versions > 0 > changes > 1 > at Ver4.00 Update 5
containers > cna > affected > 2 > versions > 0 > changes > 1 > status affected
containers > cna > affected > 3 > vendor EG Secure Solutions Inc.
containers > cna > affected > 3 > product SiteGuard Server Edition for Apache httpd on FreeBSD
containers > cna > affected > 3 > defaultStatus unaffected
containers > cna > affected > 3 > versions > 0 > version Ver2.20
containers > cna > affected > 3 > versions > 0 > status affected
containers > cna > affected > 3 > versions > 0 > versionType semver
containers > cna > affected > 3 > versions > 0 > lessThan Ver7.00 Update 6
containers > cna > affected > 4 > vendor EG Secure Solutions Inc.
containers > cna > affected > 4 > product SiteGuard Server Edition for Nginx on FreeBSD
containers > cna > affected > 4 > defaultStatus unaffected
containers > cna > affected > 4 > versions > 0 > version Ver2.20
containers > cna > affected > 4 > versions > 0 > status affected
containers > cna > affected > 4 > versions > 0 > versionType semver
containers > cna > affected > 4 > versions > 0 > lessThan Ver7.00 Update 6
containers > cna > descriptions > 0 > lang en
containers > cna > descriptions > 0 > value SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
containers > cna > problemTypes > 0 > descriptions > 0 > description Improper neutralization of special elements used in an OS command ('OS Command Injection')
containers > cna > problemTypes > 0 > descriptions > 0 > lang en-US
containers > cna > problemTypes > 0 > descriptions > 0 > cweId CWE-78
containers > cna > problemTypes > 0 > descriptions > 0 > type CWE
containers > cna > references > 0 > url https://www.eg-secure.co.jp/siteguard/news/alert-202610-1
containers > cna > references > 1 > url https://jvn.jp/en/jp/JVN88474777/
containers > cna > metrics > 0 > format CVSS
containers > cna > metrics > 0 > scenarios > 0 > lang en-US
containers > cna > metrics > 0 > scenarios > 0 > value GENERAL
containers > cna > metrics > 0 > cvssV3_0 > version 3.0
containers > cna > metrics > 0 > cvssV3_0 > baseSeverity HIGH
containers > cna > metrics > 0 > cvssV3_0 > baseScore 7.8
containers > cna > metrics > 0 > cvssV3_0 > vectorString CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
containers > cna > metrics > 1 > format CVSS
containers > cna > metrics > 1 > scenarios > 0 > lang en-US
containers > cna > metrics > 1 > scenarios > 0 > value GENERAL
containers > cna > metrics > 1 > cvssV4_0 > version 4.0
containers > cna > metrics > 1 > cvssV4_0 > baseSeverity HIGH
containers > cna > metrics > 1 > cvssV4_0 > baseScore 8.5
containers > cna > metrics > 1 > cvssV4_0 > vectorString CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
containers > cna > providerMetadata > orgId ede6fdc4-6654-4307-a26d-3331c018e2ce
containers > cna > providerMetadata > shortName jpcert
containers > cna > providerMetadata > dateUpdated 2026-10-14T09:09:32.417Z
containers > adp > 0 > metrics > 0 > other > type ssvc
containers > adp > 0 > metrics > 0 > other > content > id CVE-2026-106931
containers > adp > 0 > metrics > 0 > other > content > role CISA Coordinator
containers > adp > 0 > metrics > 0 > other > content > options > 0 > Exploitation active
containers > adp > 0 > metrics > 0 > other > content > options > 1 > Automatable no
containers > adp > 0 > metrics > 0 > other > content > options > 2 > Technical Impact total
containers > adp > 0 > metrics > 0 > other > content > version 2.0.3
containers > adp > 0 > metrics > 0 > other > content > timestamp 2026-10-20T19:46:31.419792Z
containers > adp > 0 > metrics > 1 > other > type kev
containers > adp > 0 > metrics > 1 > other > content > dateAdded 2026-10-20
containers > adp > 0 > metrics > 1 > other > content > reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-106931
containers > adp > 0 > references > 0 > url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-106931
containers > adp > 0 > references > 0 > tags > 0 government-resource
containers > adp > 0 > title CISA ADP Vulnrichment
containers > adp > 0 > providerMetadata > orgId 134c704f-9b21-4f2e-91b3-4a467353bcc0
containers > adp > 0 > providerMetadata > shortName CISA-ADP
containers > adp > 0 > providerMetadata > dateUpdated 2026-10-20T19:58:23.590Z
containers > adp > 0 > timeline > 0 > time 2026-10-20T00:00:00.000Z
containers > adp > 0 > timeline > 0 > lang en
containers > adp > 0 > timeline > 0 > value CVE-2026-106931 added to CISA KEV