Loading story…
Attackers are actively exploiting CVE-2026-106931, a critical OS command-injection vulnerability in SiteGuard Server Edition, to execute commands with root or SYSTEM privileges. The flaw affects the host-based web application firewall’s statistics function, which is enabled by default. Affected version ranges differ by platform. The attackers, victims, scale of exploitation, and specific exploitation methods have not been disclosed.
Vendor EG Secure Solutions issued an emergency advisory and provides updates and replacement-file patches, including fixes for end-of-life versions. Administrators should identify affected deployments and prioritize remediation, but preserve diagnostic information before applying fixes: the vendor warns that remediation may erase evidence of exploitation. Organizations should assess potentially affected systems for compromise rather than treating patching alone as incident resolution.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
Japan’s vulnerability coordination service published a JVN advisory concerning CVE-2026-106931 in SiteGuard Server Edition. The OS command-injection flaw affects the default-enabled statistics-processing function and can allow commands to execute with root or SYSTEM privileges.
SiteGuard notified customers with direct support contacts about the SiteGuard Server Edition vulnerability on September 29.
SiteGuard made updates and replacement-file patches available to address the vulnerability, including patches for end-of-life versions. The vendor warned that remediation could erase attack evidence and advised administrators to preserve diagnostic information first.
SiteGuard and JPCERT/CC confirmed exploitation of a critical OS command-injection flaw in SiteGuard Server Edition’s default-enabled statistics function, allowing commands to run as root or SYSTEM. They did not disclose the attackers, victims, attack scale, or exploitation methods.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
6 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecert.ug
Open sourcesecurityaffairs.com
Open sourcecyberveille.ch
Open sourcebleepingcomputer.com
Open sourceeg-secure.co.jp
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively exploiting **CVE-2022-44877**, a command injection vulnerability in Control Web Panel (CWP) that enables remote code execution through crafted HTTP requests. FortiGuard Labs reported observing attack attempts and cited Shodan findings suggesting thousands of servers could remain vulnerable. Successful exploitation could enable ransomware deployment or data exfiltration; the supplied report does not establish that either outcome occurred. FortiGuard dates CWP security patches to August 25, 2022, and reports that CISA added the vulnerability to its **Known Exploited Vulnerabilities** catalog on January 17, 2023. FortiGuard released an intrusion prevention signature and recommends updating CWP to the latest version. Organizations operating CWP should prioritize patching, verify their installed version against the vendor’s changelog, and review exposed servers for signs of exploitation.
Oct 9, 2026
Attackers are actively exploiting a command injection vulnerability in Fortinet FortiWeb, tracked as CVE-2025-58034, which allows authenticated users to execute unauthorized code on affected systems. The flaw, caused by improper neutralization of special elements in the `policy_scripting_post_handler` method, enables code execution as root via crafted HTTP requests or CLI commands. Fortinet released patches for affected FortiWeb versions between October 23 and 31, 2025, but did not publicly disclose the vulnerability at the time. The issue was privately reported by a Trend Micro researcher, and both Fortinet and CISA have confirmed active exploitation, with CISA adding the CVE to its Known Exploited Vulnerabilities catalog and mandating rapid remediation for US federal agencies. Security researchers warn that proof-of-concept code for CVE-2025-58034 may soon be publicly available, increasing the risk of widespread attacks. There is currently no workaround for this vulnerability, and organizations are urged to upgrade to the fixed FortiWeb versions immediately and check for signs of compromise. The vulnerability requires authentication to exploit, but successful exploitation grants attackers root-level access. The disclosure timeline shows the vulnerability was reported in June 2025 and publicly disclosed in November 2025, with coordinated advisories from both Fortinet and the Zero Day Initiative.
Jun 29, 2026
Cisco released fixes for **CVE-2026-20262**, an actively exploited vulnerability in **Cisco Catalyst SD-WAN Manager** (`vManage`) that allows an authenticated remote attacker with low privileges to upload or overwrite files through crafted HTTP requests and ultimately execute commands as **root**. The flaw stems from insufficient validation of user-supplied input during file uploads in the web UI and affects **all deployment models**, including on-premises, Cloud-Pro, Cisco-managed cloud, and FedRAMP environments. Cisco said it became aware of in-the-wild exploitation in June and urged customers to patch immediately, warning that the product’s central role in orchestrating SD-WAN fabrics raises the operational impact of compromise. The company published indicators of compromise tied to uploaded `.jsp` and `.war` files, including filenames such as `index.jsp` and `suspicious.war`, and advised defenders to inspect `vmanage-server`, `vmanage-appserver`, and `serviceproxy-access` logs, reduce internet exposure, audit accounts, and contact TAC with an admin-tech file if intrusion is suspected.
Aug 15, 2026