CISA added CVE-2026-106931 to its Known Exploited Vulnerabilities catalog on October 20. The flaw sits in SiteGuard Server Edition, a host-based web application firewall for Apache, Nginx and IIS. CISA says command injection may execute arbitrary operating-system commands with “root or SYSTEM privileges” on the server running it. It lists October 23 as the action date for its directive-based response.
The vendor says exploitation has already been confirmed. Its advisory identifies the statistics feature as the affected component and says that feature is enabled by default. An operator preparing an update has an immediate evidence-preservation step: download the product’s diagnostic information before applying the fix, because the update or patch can erase attack traces.
Statistics processing reaches host privileges
This is an OS command-injection flaw in the WAF’s statistics processing. A command that reaches the vulnerable processing path could run with the host privileges CISA describes. That puts the machine hosting the web application at risk, even though SiteGuard is installed to protect it. The CVE Program record classifies the issue as CWE-78 and describes local, low-privilege attack conditions (AV:L, PR:L) in its severity vectors. Assess local, low-privilege access to each SiteGuard host under those vectors; CISA also asks owners to check each asset’s internet exposure.
The vendor’s scope is specific: SiteGuard Server Edition installations from Ver2.20 onward with statistics enabled, which is the default. The product runs in Apache, Nginx and IIS editions, including FreeBSD Apache and Nginx editions. The exception is IIS Ver3.10 through Ver4.00 Update4, which the vendor excludes from this vulnerability. Match the installed edition, release and statistics setting on each server; the edition changes the fixed-release threshold.
Match the release to its edition
For Apache, Nginx and IIS editions outside FreeBSD, the vendor fixes the vulnerability in Ver8.00 Update5. For FreeBSD Apache and Nginx editions, the first fixed release is Ver7.00 Update6. EG Secure Solutions also offers a patch that replaces the file used for statistics processing for customers unable to upgrade, including those on versions whose support has ended. Obtain the update or patch through the vendor’s published support route, and record which fix was actually installed on each host.
The vendor told customers with direct support contracts about the issue and countermeasures on September 29, before its public October 14 advisory. CISA’s October 20 KEV addition raises the priority of locating SiteGuard across the web-server inventory. The CISA entry also calls for vendor-directed mitigation, an internet-exposure assessment for each asset and forensic triage. Record each server’s internet exposure alongside its local-access review so responders can prioritize affected hosts.
Preserve diagnostics before changing files
On each affected host, use the SiteGuard web management screen’s Diagnostic Information → Download Diagnostic Information control to save its diagnostic package before patching. Store that copy under your incident evidence process, then install the correct release or obtain the vendor patch. If a server may have been accessed, have the response team examine its retained diagnostic package alongside available host authentication and process-execution records. Possible root or SYSTEM command execution warrants a host investigation alongside the WAF fix.
After the change, verify the installed edition and fixed release on that host, or confirm the vendor patch was applied to its statistics-processing file. Recheck that the statistics feature’s intended setting remains in place. For the retrospective review, preserve the pre-change diagnostic copy: a clean-looking post-update package cannot replace evidence collected before the update. Keep the server in the response queue if the available host records leave earlier privileged execution unresolved.
SiteGuard hosts need two checks
Start with the installed SiteGuard edition, version and statistics setting. That comparison identifies the affected hosts and the correct vendor fix. On a host that falls in scope, download diagnostic information before changing the product, update to Ver8.00 Update5 or Ver7.00 Update6 as appropriate, or apply the vendor’s statistics-processing patch. Confirm the resulting release or patch state on the host and hand preserved diagnostics to responders when earlier access is suspected.
A fixed WAF stops future use of this flaw; review the saved diagnostics and host records for earlier privileged commands. Keep the pre-update diagnostic package with the host’s access and process history so the remediation decision and the intrusion review use the same server and timeframe.