On October 20, 2026, CISA added two vulnerabilities to its KEV catalog that share nothing on the vendor side but a lot on the attack side: CVE-2026-106931 in SiteGuard Server Edition (EG Secure Solutions) and CVE-2026-110936 in Siemens Software Center.
Both require local access to the machine (AV:L). Neither gets an attacker in. They serve those already inside: grabbing root or SYSTEM rights, or getting a trusted application to run their code. And both are being exploited, less than a week after publication.
At a Glance
| CVE-2026-106931 | CVE-2026-110936 | |
|---|---|---|
| Product | SiteGuard Server Edition | Siemens Software Center |
| Type | OS command injection (CWE-78) | Uncontrolled search path, DLL (CWE-427) |
| CVSS 3 score (CNA) | 7.8 (HIGH), JPCERT/CC | 6.7 (MEDIUM), Siemens |
| CVSS 4.0 (CNA) | 8.5 (HIGH), JPCERT/CC | 8.4 (HIGH), Siemens |
| Privileges required | low (PR:L) | high (PR:H) |
| NVD status | Deferred | Undergoing Analysis |
| NVD publication | 2026-10-14 | 2026-10-15 |
| Added to CISA KEV | 2026-10-20 | 2026-10-20 |
| CISA deadline | 2026-10-23 | 2026-11-03 |
Neither score comes from NVD: they're the CNAs' (JPCERT/CC for SiteGuard, Siemens ProductCERT for Software Center). Published vectors (CVSS 3.0 for SiteGuard, CVSS 3.1 for Siemens):
- CVE-2026-106931:
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVE-2026-110936:
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVE-2026-106931: SiteGuard Server Edition
NVD description:
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
SiteGuard Server Edition is a web application firewall installed directly on the server it protects. That's what makes the flaw serious: the product runs with the machine's highest privileges, and the injection lets an attacker run commands with them. With PR:L, a plain local account is enough according to JPCERT/CC's vector.
Affected versions: NVD publishes no CPE configuration and no version bounds (the record is Deferred). To find out whether your version is affected and which one to install, go to the vendor's notice (eg-secure.co.jp/siteguard/news/alert-202610-1) and to JVN88474777.
The CISA deadline is very short: three days, until October 23.
CVE-2026-110936: Siemens Software Center
NVD description (excerpt):
The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
This is textbook DLL hijacking: the application looks for a library in a directory an attacker can write to, and loads theirs. The code then runs with Software Center's privileges, under the identity of a Siemens-signed binary.
Affected versions: all versions before V4.0.9.8, per the NVD description (no CPE configuration yet; the record is still being analyzed). V4.0.9.8 is the stated bound, not necessarily the latest release: check advisory SSA-580366.
On October 19, Siemens published a dedicated note on active exploitation of this CVE (linked in NVD's references), one day before the KEV addition.
Why Local Flaws End Up in KEV
An AV:L drops the priority in most patching processes: "you'd already have to be on the box." That's exactly what attackers are after once they have a first foothold (phishing, stolen credentials, another flaw):
- SiteGuard offers a direct jump to root or SYSTEM on a web server, often an internet-facing one;
- Software Center lets an attacker run code under the cover of a legitimate application, which helps them stay under the radar.
Neither NVD nor CISA describes the campaigns. Both flaws fit the profile of a post-compromise step: that's an inference, not published information. The ransomware link is listed as unknown for both.
Detection
SiteGuard Server Edition
- Unusual child processes (shells,
cmd.exe, PowerShell,curl,wget) spawned by SiteGuard processes - Recently created local accounts, scheduled tasks or SSH keys on protected servers
- Changes to SiteGuard's configuration or files with no matching maintenance work
Siemens Software Center
- Recently added DLLs in Software Center's install directories, or in user-writable directories the application searches
- Unsigned DLLs loaded by the Software Center process (Sysmon, event 7)
- Unexpected child processes or network connections from Software Center
Mitigation
- SiteGuard: apply the update described in EG Secure Solutions' notice before October 23. Meanwhile, keep local accounts and shell access on protected servers to the bare minimum.
- Software Center: update to V4.0.9.8 or later (CISA deadline: November 3), and check write permissions on the install directories: a standard user must not be able to drop files there.
- For both: BOD 26-04, cited by CISA, calls for forensic triage. An update removes neither a planted DLL nor an account or persistence created by a command run as root.
Why "Local" Flaws Deserve Continuous Monitoring
Two CVEs rated HIGH and MEDIUM, with a local vector: most teams would have put them at the bottom of the pile. Five to six days after publication, they're in KEV with three days and two weeks to fix.
With cveo.tech, inventory the software installed on your servers and workstations, including security and deployment tools, and get an alert as soon as a CVE affecting them enters the CISA KEV catalog, whatever its vector.