CVE-2026-106931
EG Secure Solutions Inc. SiteGuard Server Edition for Apache httpd
At a glance
- Source
- NVD
- EPSS
- EPSS 2.53 % · percentile 85 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- jpcert
- NVD status
- Analyzed
Description
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
Weaknesses (CWE)
- CWE-78 — OS Command Injection
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | HIGH 7.8 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | jpcert |
| CVSS 4.0 | HIGH 8.5 | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | jpcert |
| CVSS 4.0 | HIGH 8.5 | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · vultures@jpcert.or.jp (Secondary) |
| CVSS 3.0 | HIGH 7.8 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · vultures@jpcert.or.jp (Secondary) |
European references
- ENISA EUVD · EUVD-2026-100814
- GCVE · GCVE-0-2026-106931
Affected configurations (NVD CPE)
cpe:2.3:a:e-guardian:siteguard:*:*:*:*:server:apache:*:*≥ 2.20 < 8.00cpe:2.3:a:e-guardian:siteguard:8.00:-:*:*:server:apache:*:*cpe:2.3:a:e-guardian:siteguard:8.00:update1:*:*:server:apache:*:*cpe:2.3:a:e-guardian:siteguard:8.00:update2:*:*:server:apache:*:*cpe:2.3:a:e-guardian:siteguard:8.00:update3:*:*:server:apache:*:*cpe:2.3:a:e-guardian:siteguard:*:*:*:*:server:apache:*:*≥ 2.20 < 7.00cpe:2.3:a:e-guardian:siteguard:7.00:-:*:*:server:apache:*:*cpe:2.3:a:e-guardian:siteguard:7.00:update1:*:*:server:apache:*:*cpe:2.3:a:e-guardian:siteguard:7.00:update2:*:*:server:apache:*:*cpe:2.3:a:e-guardian:siteguard:7.00:update3:*:*:server:apache:*:*cpe:2.3:a:e-guardian:siteguard:7.00:update4:*:*:server:apache:*:*cpe:2.3:a:e-guardian:siteguard:7.00:update5:*:*:server:apache:*:*cpe:2.3:a:e-guardian:siteguard:*:*:*:*:server:nginx:*:*≥ 2.20 < 8.00cpe:2.3:a:e-guardian:siteguard:8.00:-:*:*:server:nginx:*:*cpe:2.3:a:e-guardian:siteguard:8.00:update1:*:*:server:nginx:*:*cpe:2.3:a:e-guardian:siteguard:8.00:update2:*:*:server:nginx:*:*cpe:2.3:a:e-guardian:siteguard:8.00:update3:*:*:server:nginx:*:*cpe:2.3:a:e-guardian:siteguard:*:*:*:*:server:nginx:*:*≥ 2.20 < 7.00cpe:2.3:a:e-guardian:siteguard:7.00:-:*:*:server:nginx:*:*cpe:2.3:a:e-guardian:siteguard:7.00:update1:*:*:server:nginx:*:*cpe:2.3:a:e-guardian:siteguard:7.00:update2:*:*:server:nginx:*:*cpe:2.3:a:e-guardian:siteguard:7.00:update3:*:*:server:nginx:*:*cpe:2.3:a:e-guardian:siteguard:7.00:update4:*:*:server:nginx:*:*cpe:2.3:a:e-guardian:siteguard:7.00:update5:*:*:server:nginx:*:*cpe:2.3:a:e-guardian:siteguard:*:*:*:*:server:internet_information_services:*:*≥ 2.20 < 3.10cpe:2.3:a:e-guardian:siteguard:*:*:*:*:server:internet_information_services:*:*≥ 4.10 < 8.00cpe:2.3:a:e-guardian:siteguard:8.00:update4:*:*:server:internet_information_services:*:*
Affected products
| Product | Versions |
|---|---|
| EG Secure Solutions Inc. · SiteGuard Server Edition for Apache httpd | affected Ver2.20 < Ver8.00 Update 5 |
| EG Secure Solutions Inc. · SiteGuard Server Edition for Nginx | affected Ver2.20 < Ver8.00 Update 5 |
| EG Secure Solutions Inc. · SiteGuard Server Edition for IIS | affected Ver2.20 < Ver8.00 Update 5 |
| EG Secure Solutions Inc. · SiteGuard Server Edition for Apache httpd on FreeBSD | affected Ver2.20 < Ver7.00 Update 6 |
| EG Secure Solutions Inc. · SiteGuard Server Edition for Nginx on FreeBSD | affected Ver2.20 < Ver7.00 Update 6 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |