← Vulnerability feed

Vulnerability record · CVE-2026-106931 · published 14 October 2026

CVE-2026-106931: E-guardian siteguard os command injection vulnerability

E Guardian · Siteguard

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

8.5 CVSS 4.0 High CISA KEV since 20 Oct 2026 EPSS 2.5% · top 14.9% CWE-78 · OS command injection
8.5CVSS 4.0 base score
2.5%EPSS exploitation probability, 30 days
YesIn CISA KEV, fix deadline passed
1Affected product versions listed by NVD
3References
21 Oct 2026Last modified by NVD

Description

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Exploitation in the wild

CISA added CVE-2026-106931 to the Known Exploited Vulnerabilities catalog on 20 October 2026 as "EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability". Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal deadline 23 October 2026.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://jvn.jp/en/jp/JVN88474777/ Third Party Advisory
https://www.eg-secure.co.jp/siteguard/news/alert-202610-1 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-106931 US Government Resource

Track CVE-2026-106931 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.6CVE-2026-111560Barracuda email security gateway 300 firmware os command injection vulnerabilityImproper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda co…KEVEPSS 6.2%9.8CVE-2026-116779Freeswitch command injection vulnerabilityFreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation tha…KEVEPSS 2.5%7.8CVE-2026-46300Linux kernel out-of-bounds write vulnerabilityIn the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can…KEVEPSS 16%9.2CVE-2026-111497Google brotli unchecked return value vulnerabilityA buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote…KEVEPSS 83%9.2CVE-2026-110447Collabora online - built-in code server os command injection vulnerabilityCollabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in…KEVEPSS 73%10.0CVE-2026-105134Ahsay cloud backup suite command injection vulnerabilityA flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.…KEVEPSS 82%8.8CVE-2026-86950Apple ipados out-of-bounds write vulnerabilityAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadO…KEVEPSS 26%8.8CVE-2026-53266Linux kernel ebtables SNAT out-of-bounds write in ARP rewriteThe ebtables SNAT target rewrites the ARP sender hardware address via skb_store_bits() without first making that range writable. When the ARP SHA byt…KEVEPSS 0.93%analysed

Source: NIST National Vulnerability Database (record CVE-2026-106931), CISA KEV, FIRST EPSS (scores of 2026-11-11). This page is refreshed as NVD updates the record.