Zero Radar
← feed
CriticalVulnerabilityCVE-2026-106931updated 25 Oct 2026, 17:20 UTC

SiteGuard Server Edition: attackers can run system commands as admin

A flaw in SiteGuard Server Edition lets an attacker type commands that the server then runs on its own. Because those commands run with the highest system rights, the attacker can take full control of the machine.

Exploited (CISA KEV)Official, 2 sources
SeverityCriticalCVSS 8.5 of 10
Being exploited?YesConfirmed by CISA KEV · 20 Oct 2026
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

What happened

SiteGuard Server Edition by EG Secure Solutions has an OS command injection vulnerability that allows arbitrary operating system commands to be executed with root or SYSTEM privileges.

Why it is dangerous: An attacker who can reach the affected server could take complete control of it, which can expose or alter the data and other systems it touches. Organizations running SiteGuard Server Edition, especially with internet-facing instances, are at risk.

Are you affected?

You are affected if you run SiteGuard Server Edition from EG Secure Solutions on a system you have not yet patched or mitigated.

SiteGuard Server Edition (EG Secure Solutions); specific versions unknown

What to do

  1. Check the vendor's advisory and apply the mitigation or update it provides for SiteGuard Server Edition
  2. Review whether the server is exposed to the internet and restrict access to it if possible
  3. If no mitigation is available, discontinue use of the product, following CISA BOD 26-04 guidance
  4. Perform forensic triage on the system to check for signs of compromise

Timeline

  1. 14 Oct 2026, 06:31 UTC
    Publicly disclosed
  2. 20 Oct 2026, 00:00 UTC
    Reported by CISA KEV · CISA KEV
  3. 25 Oct 2026, 17:20 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-106931 · GHSA-rhmj-5mp2-rq7c
CVSS
8.5 / 10
EPSS
2.5% chance of exploitation within 30 days
Disclosed
14 Oct 2026, 06:31 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

SiteGuard Server Edition: attackers can run system commands as admin · Zero Radar