CVE-2026-26093 is a critical command injection flaw (CVSS 9.8) in Owl Cyber Defense opds 2.2.0.4, reachable through a crafted network request. Nozomi Networks suggests updating to Talon v3.0 and lists no other mitigation. The record does not list it in CISA's KEV catalog, and the sources we read do not report exploitation.
What's affected
- Owl opds version 2.2.0.4
- Products named in the record: opds-100, opds-1000 and opds-talon
- Fix suggested by Nozomi Networks: update to Talon v3.0
The Nozomi page lists no mitigations. The record gives very little technical detail, so we stay with what the advisory says.
How to check if you're exposed
Look up the software version on each Owl device in your environment. Owl products are one way data transfer devices that sit between networks, so find the inventory record for each, and where it sits in your architecture. Compare the version with 2.2.0.4.
If you cannot read the version yourself, ask the party that manages the device or Owl support. Check the Nozomi advisory for the latest guidance.
What to do now
- Plan the update to Talon v3.0 as the advisory suggests, and confirm applicability for your model with Owl.
- Review which networks can send requests to the device and tighten them.
- Record the device, version and update date in your asset inventory.
- Monitor the devices for unexpected behavior until the update is installed.
- Ask your vendor whether older models need a different upgrade path.
Why it matters
CWE-77 is improper neutralization of special elements in a command: input from the network reaches a command interpreter, and special characters change what runs. The record says only that a crafted network request can cause it. It gives no details of the request, and we do not guess.
The context raises the stakes. Devices that enforce one way transfers between networks exist to keep sensitive systems separate. A flaw that allows command injection in such a device threatens the assumption the design rests on. Treat the device like any other critical boundary component and keep it current.
The score of 9.8 reflects network reach, no privileges, no user interaction and full impact.
Quick check
What is the fix?
Nozomi says to update to Talon v3.0. Confirm the path for your specific model with the vendor.
Is it exploited?
The record's KEV flag is false and the advisory does not report exploitation.
Sources
Last reviewed: 19 October 2026.
