1-minute read
What a defender needs to know
CISA added CVE-2026-106931 to its exploited-vulnerabilities catalog on October 20, with an October 23 action date. The flaw affects the statistics function in EG Secure Solutions’ SiteGuard Server Edition, a host-based WAF. The vendor says exploitation is confirmed. The function is enabled by default, and command injection may run with root or SYSTEM privileges on the host. The CVE severity vector specifies local, low-privilege access (AV:L, PR:L); assess local access to the affected server as well as its internet exposure.
Inventory SiteGuard edition, version and statistics setting on Apache, Nginx and IIS servers. Affected installations start at Ver2.20 and run below Ver8.00 Update5 for non-FreeBSD editions, or below Ver7.00 Update6 for FreeBSD Apache and Nginx. IIS Ver3.10 through Ver4.00 Update4 is excluded. For an affected host, use Diagnostic Information → Download Diagnostic Information in the product’s web management screen before updating: the vendor warns that patching can erase attack traces. Then apply the appropriate fixed release or request the vendor’s statistics-processing patch, including versions whose support has ended.
Verify the installed edition and release, or the applied patch state, after the change. Preserve the pre-update diagnostic package for responders to compare with host authentication and process-execution history if earlier access is suspected. A successful update addresses the flaw going forward; investigate possible earlier privileged commands separately.