CVE-2026-106931: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability

According to Security Affairs, EG Secure Solutions published an urgent alert warning of CVE-2026-106931, an OS command injection bug in SiteGuard Server Edition.[2] BleepingComputer quotes SiteGuard's alert as saying: "Abuse has already been confirmed"[1].Cyber Kendra reports that the flaw carries a CVSS v4 score of 8.5 (7.8 under CVSS v3) and sits in the product's statistics feature, which ships enabled by default.[3] The outlet adds that Japan Vulnerability Notes rates the issue critical in its advisory, and JPCERT/CC issued an emergency alert the same day[3].Security Affairs says an attacker needs local access and low-level privileges to exploit this vulnerability.[2] Cyber Kendra notes that neither EG Secure Solutions nor JPCERT/CC has named the attackers, said how many customers were compromised, or explained how the initial access was obtained.[3]According to BleepingComputer, the vendor says versions 2.20 and later, before 8.00 Update 5[1] are affected on Apache httpd, Nginx and IIS. That excludes FreeBSD, where Apache and Nginx editions are affected before 7.00 Update 6.[1] The outlet says IIS editions 3.10 through 4.00 Update 4, inclusive, are not affected, JPCERT/CC notes.[1]Security Affairs reports that the vendor offers a patch that replaces the files used in statistics processing, and it covers end-of-life versions too.[2] SC Media reports that SiteGuard advises administrators to preserve diagnostic information before applying updates or patches, as remediation may erase evidence of the attack.[4]Windows Forum reports that the flaw was privately disclosed to support-contract customers on September 29, 2026, and publicly disclosed on October 14, 2026.[5]