Attackers are exploiting CVE-2026-106931 in SiteGuard Server Edition for root or SYSTEM. CISA wants it fixed by 23 October; save diagnostics first.
EG Secure Solutions has confirmed that attackers are already exploiting CVE-2026-106931, an OS command injection flaw in SiteGuard Server Edition, a web application firewall that runs on the web server itself. CISA added it to its Known Exploited Vulnerabilities catalog on 20 October with a remediation due date of 23 October. Anyone running an unpatched Apache, Nginx or IIS edition of the product, or the FreeBSD builds, is affected.
What is affected
The flaw sits in the product's statistics feature, which is enabled by default. Per the vendor, versions from Ver2.20 are affected until the fixed releases below. IIS editions from Ver3.10 through Ver4.00 Update4 are listed as not affected. Commands run with root privileges on Unix-like hosts and SYSTEM on Windows, so a successful attack hands over the whole web server host.
| Edition | Fixed in |
|---|---|
| Apache, Nginx, IIS | Ver8.00 Update5 |
| FreeBSD Apache, Nginx | Ver7.00 Update6 |
Severity and the "local" caveat
JPCERT/CC scored the flaw CVSS v4.0 8.5 (v3.0: 7.8). The vector is local with low privileges required and no user interaction. That is lower than the impact suggests: the score reflects an attacker who already has some foothold on the host, for example a low-privileged account, a compromised web application, or another bug. It does not mean the flaw is harmless from the network. The vendor and JVN both say exploitation has been confirmed, and the root/SYSTEM outcome makes it a strong privilege-escalation step. NVD lists the record as Deferred, so it has not yet added its own analysis.
Collect diagnostics before you patch
The vendor's most unusual instruction is about order. Before updating or applying the patch, download the diagnostic information from the web admin console (Diagnostics, then Download diagnostic information) and store it. The vendor warns that updating or patching may erase traces of an attack. If you patch first, you may lose the only record showing whether the host was already compromised.
Timeline
From the first customer notice to CISA's due date.
From the first customer notice to CISA's due date.
- 29 September: vendor notifies customers with direct support contracts.
- 14 October: advisory, JVN entry (JVN#88474777) and CVE record go public.
- 20 October: CISA adds the flaw to KEV.
- 23 October: CISA due date.
What defenders should do
- Inventory SiteGuard Server Edition installs, including end-of-support versions, and check whether statistics is enabled.
- Download and preserve the diagnostic information from each admin console before changing anything. Copy it off the host.
- Update to Ver8.00 Update5 (Ver7.00 Update6 on FreeBSD). If you cannot upgrade, apply the vendor patch, which replaces the files used for statistics processing. It is also offered for end-of-support versions.
- Treat any host that ran an affected version as potentially compromised, since exploitation predates public disclosure of the fix (support customers were warned on 29 September). Review the preserved diagnostics and host logs for unexpected commands, new accounts, persistence and outbound connections.
- US federal civilian agencies must remediate by CISA's 23 October KEV due date.