U.S. CISA adds a flaw in Soliton Systems K.K FileZen to its Known Exploited Vulnerabilities catalog
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-25108 | Authenticated OS Command Injection in Soliton FileZen Exploited in the Wild Soliton Systems' FileZen contains an OS command injection flaw (CWE-78) that allows a logged-in user to execute arbitrary operating system commands by sending a specially crafted HTTP request. The vulnerability is only triggerable when the FileZen Antivirus Check Option is enabled, so deployments without that option are not exposed to this specific attack path. Successful exploitation yields full command execution on the host, reflected in the high confidentiality, integrity, and availability impacts and the 8.7 (High) CVSS 4.0 score. Any organization running Soliton FileZen with the Antivirus Check Option enabled is affected, particularly those exposing the management or transfer interface to untrusted networks. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-02-24, confirming active exploitation in the wild, though no public proof-of-concept is known and ransomware use is listed as unknown. Do: Apply the vendor's mitigations or updated software per Soliton's instructions immediately, as the flaw is confirmed exploited in the wild and carries a BOD 22-01 obligation for US federal agencies. As an interim measure, consider disabling the Antivirus Check Option or restricting network access to the FileZen interface, and review web/application logs for suspicious authenticated HTTP requests or unexpected command execution. Verify current FileZen versions against the vendor/JPCERT advisory to confirm you are on a fixed release. | 8.7 | 5% | KEV |
| nichelikely thousands of deployments, concentrated in Japan (no public install counts available) |
Full article381 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
February 25, 2026
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a flaw in Soliton Systems K.K FileZen to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Soliton Systems K.K FileZen flaw, tracked as CVE-2026-25108 (CVSS v4 score of 8.7), to its Known Exploited Vulnerabilities (KEV) catalog.
Soliton Systems K.K. FileZen is a secure file transfer solution that enables organizations to share and manage sensitive data safely. It provides access controls, activity logging, and antivirus scanning.
The vulnerability is an operating system (OS) command injection that could allow an authenticated user to execute arbitrary commands via specially crafted HTTP requests.
“Command Injection Vulnerability in a Specific Field on the Post-Logon Screen (CWE-78)” reads the advisory. “A remote attacker may be able to execute arbitrary OS commands within FileZen.”
The vulnerability can be exploited only if two conditions are met: the FileZen virus check feature (BitDefender-based) is enabled, and an attacker has valid login access to the FileZen website, either through leaked credentials or successfully guessed user IDs and passwords.
The flaw impacts Versions 5.0.0 to 5.0.10 and Versions 4.2.1 to 4.2.8. V5.0.11 or later address the flaw.
Soliton is aware of the active exploitation of this flaw:
“We have received at least one report of damage caused by the exploitation of this vulnerability.” reads the advisory. “For this vulnerability to occur, an attacker must log on to the web screen with general user privileges. If you have been attacked or suspected of being a victim of this vulnerability, please consider not only updating to V5.0.11 or later, but also changing all user passwords as a precaution, since an attacker could log on with at least one real account.”
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the vulnerability by March 17, 2026.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, US CISA Known Exploited Vulnerabilities catalog)
“
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/188473/hacking/u-s-cisa-adds-a-flaw-in-soliton-systems-k-k-filezen-to-its-known-exploited-vulnerabilities-catalog.html