Waf

vulnerabilities 2026-10-25
SiteGuard WAF CVE-2026-106931: Exploited Command Injection Gives Root/SYSTEM, and Patching Can Erase the Evidence
EG Secure Solutions' SiteGuard Server Edition WAF has an exploited OS command injection in its default-on statistics feature; CISA added it to KEV and the vendor says to save diagnostics before patching.
active-exploitation cisa-kev command-injection waf network-appliance rce

SiteGuard WAF CVE-2026-106931: Exploited Command Injection Gives Root/SYSTEM, and Patching Can Erase the Evidence