Vulnerability

CVE-2026-106931

High· 7.8KEVCVSS7.8EPSS1%

.rules3/5

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

Threat signal

88/100

Severe

Severity

high

CVSS

7.8

EPSS

Active

KEV

CISA KEV — actively exploited

1d overdue

AffectedEG Secure Solutions — SiteGuard Server Edition

Added to KEV

2026-10-20

Federal patch due (BOD 22-01)

2026-10-23

Required action (CISA verbatim)

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Vendor advisory + references

CISA description: “EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.”

CVSS

v3.0via NVDOpen in FIRST calculator →

7.8/ 10HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack VectorLocalRequires local access — shell, console, or local app.
Attack ComplexityLowNo special conditions — exploit works reliably.
Privileges RequiredLowStandard user privileges sufficient.
User InteractionNoneFully automated — no victim action needed.
ScopeUnchangedImpact contained to the vulnerable component.
Confidentiality ImpactHighTotal disclosure of sensitive data.
Integrity ImpactHighTotal compromise of integrity — full data modification possible.
Availability ImpactHighTotal loss of availability — full DoS possible.

EPSS

Exploit prediction · 30-day horizonFIRST.org →

1.17%

probability of exploitation in next 30 days

p67

higher than 67% of all CVEs

4-day trend↑ 0.5pp

Mid-pack — moderate exploitation likelihood.

Vendor VEX

No VEX statements published for CVE-2026-106931. Vendors publish VEX (Vulnerability Exploitability eXchange) to assert per-product whether a CVE is actually exploitable in their distribution.

SSVCAct

Active exploitation with total impact on essential/support systems

exploitation: active
automatable: no
impact: total
mission: support

Lifecycle

2026-10-14Published
2026-10-20Added to CISA KEVransomware: Unknown
2026-10-20Vendor advisory · cisa-aacisa-adds-six-known-exploited-vulnerabilities-catalog — CISA Adds Six Known Exploited Vulnerabilities to Catalog
2026-10-20Mentioned in rss:cisaCISA Adds Six Known Exploited Vulnerabilities to Catalog
2026-10-21Last modified2 sources
2026-10-23Federal patch due (BOD 22-01)

Entity graph

3 nodes · 2 edges · click to pivot

CVEActorVendor advisoryIOCNews

Vendor advisories

cisa-aacisa-adds-six-known-exploited-vulnerabilities-catalogCISA Adds Six Known Exploited Vulnerabilities to Catalog

Mentions in news & research

rss:cisaCISA Adds Six Known Exploited Vulnerabilities to Catalog4 d ago

CVE-2026-106931

CISA KEV — actively exploited

CVSS

EPSS

Vendor VEX

Lifecycle

Entity graph

Vendor advisories

Mentions in news & research

References

CVE-2026-106931

CISA KEV — actively exploited

CVSS

EPSS

Vendor VEX

Lifecycle

Entity graph

Vendor advisories

Mentions in news & research

References