CVE-2026-106931 When Someone Else Runs Your SiteGuard

SiteGuard Server Edition, a host-based WAF from EG Secure Solutions, contains an OS command injection vulnerability (CWE-78) within its statistics feature. Identified as CVE-2026-106931 and JVN#88474777, the flaw allows for operating system command execution. It carries a CVSS 4.0 base score of 8.5 and a CVSS 3.0 base score of 7.8. The vulnerability highlights critical observability gaps on web servers and challenges when hosting providers manage installations instead of security groups.