SiteGuard Server Edition EUVD-2026-100814

Exploitation requires LOCAL access to the host running SiteGuard Server Edition (AV:L) together with a low-privilege authenticated account or foothold (PR:L) - it is NOT remotely exploitable over the network and cannot be triggered by an anonymous external WAF client. Once that foothold exists, no user interaction is needed (UI:N) and complexity is low (AC:L); the attacker injects OS command metacharacters into an affected SiteGuard input path that is passed to a shell, escalating to root (Apache httpd/nginx on Linux or FreeBSD) or SYSTEM (IIS on Windows). The primary limiting factors are the mandatory local access and the requirement for an existing low-privilege account; the affected editions span Apache httpd, nginx, and IIS variants including FreeBSD builds, per the CPE list.

The CVSS 4.0 vector (base score 8.5) describes a LOCAL attack vector (AV:L) requiring low privileges (PR:L) with no user interaction (UI:N) and low attack complexity (AC:L), yielding high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) confined to the vulnerable system (SC:N/SI:N/SA:N). In practice this is a local privilege-escalation-class OS command injection: an attacker who already holds a low-privilege foothold on the host can execute arbitrary OS commands as root or SYSTEM. The signals are internally CONSISTENT - AV:L matches the 'on the system running the affected product' language in the description, so this is not a network-reachable bug despite being a web-infrastructure (WAF) product. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization. This tempers urgency: the high base score reflects the severe root/SYSTEM impact, not ease of remote mass-exploitation. It is a genuine priority for hardening on hosts where untrusted or lower-tier accounts exist, but the local-only vector and required pre-existing privilege substantially narrow real-world exposure compared to a network-unauthenticated flaw. EPSS/KEV absence is a data gap, not confirmation of safety.

An attacker with an existing low-privilege account or foothold on a server running SiteGuard Server Edition supplies crafted input to a vulnerable SiteGuard component, which passes it unsanitized to an OS shell. The injected command executes with root (Linux/FreeBSD) or SYSTEM (IIS/Windows) privileges, giving full host takeover. No public exploit code was identified in the provided data, and the local attack vector (AV:L) means the attacker must first obtain local/authenticated access.