SiteGuard CVE-2026-106931: root-level RCE in a WAF, exploited in the wild

EG Secure Solutions' SiteGuard Server Edition has an OS command injection (CWE-78) in its statistics module, rated 8.5 under CVSS v4.0, allowing arbitrary commands as root on Unix or SYSTEM on Windows. CISA added CVE-2026-106931 to its Known Exploited Vulnerabilities catalog on October 20, 2026, with a November 3 remediation deadline, and Japan's CERT issued an urgent advisory. The vendor warns that patching may destroy evidence, so defenders should image the appliance and forward logs first.

• CVE-2026-106931: command injection in SiteGuard statistics module, CVSS v4.0 8.5
• Exploitation confirmed; CISA added it to KEV on October 20, 2026
• CISA remediation deadline is November 3, 2026
• Patch may erase intrusion evidence: snapshot disk and export logs first