Critical CVE-2026-75937 in DAL OS rated 9.4

Digi Accelerated Linux (DAL OS) contains CVE-2026-75937, an unauthenticated OS command injection (CWE-78, CVSS 4.0 score 9.4) in its web administration service that lets attackers run commands as root via a crafted HTTP POST. Builds 21.8.24.139 through 26.7.90.14 are affected; Digi shipped three separate fixed builds, while the 54xx, 63xx, IX14 and LR54 families remain unpatched.

• CVE-2026-75937: command injection in DAL OS web UI, CVSS 4.0 score 9.4
• Affected builds range from 21.8.24.139 to 26.7.90.14
• Fixes: 26.2.148.166 LTS, 26.7.90.15 and 26.9.10.28 by model
• 54xx, 63xx, IX14 and LR54 families will stay unpatched