CVE-2026-106931

State: Published
Severity: 8.5 High
Published: Oct 14, 2026
Updated: Oct 21, 2026
Reserved: Oct 7, 2026

Description

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

Scores

CVSS	Score	Vector	Source
4.0	8.5 High	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	jpcert
3.0	7.8 High	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	jpcert

Weaknesses

CWE-78 Improper neutralization of special elements used in an OS command ('OS Command Injection')

Affected Products

Product	Versions
SiteGuard Server Edition for Apache httpdEG Secure Solutions Inc.	Ver2.20 to before Ver8.00 Update 5Affected
SiteGuard Server Edition for NginxEG Secure Solutions Inc.	Ver2.20 to before Ver8.00 Update 5Affected
SiteGuard Server Edition for IISEG Secure Solutions Inc.	Ver2.20 to before Ver8.00 Update 5Affectedfrom Ver3.10Not affectedfrom Ver4.00 Update 5Affected
SiteGuard Server Edition for Apache httpd on FreeBSDEG Secure Solutions Inc.	Ver2.20 to before Ver7.00 Update 6Affected
SiteGuard Server Edition for Nginx on FreeBSDEG Secure Solutions Inc.	Ver2.20 to before Ver7.00 Update 6Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.