In CISA KEV8.8 HighCWE-78
CVE-2026-25108
Soliton Systems K.K FileZen OS Command Injection Vulnerability
Soliton Systems K.KFileZen
Status
- Exploited in the wild
- In CISA KEV since 24 Feb
Federal deadlineTue 17 Mar, 23:59 UTC
Passed 221 days ago
CISA KEV · added 24 Feb
Exploit probabilityEPSSchecked 25 Oct
5.3%probability of exploitation in the next 30 days
Higher than 92% of scored CVEs
SeverityCVSS
8.8High
Description NVD
FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a specially crafted HTTP request to execute an arbitrary OS command.
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 4 articles · 3 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 25 Feb · 06:20 UTC | The Hacker News | CISA warns FileZen file server CVE-2026-25108 is being exploited |
| Wed 25 Feb · 10:01 UTC | Security Affairs | CISA orders patch for FileZen file transfer flaw CVE-2026-25108 |
| Wed 25 Feb · 13:17 UTC | CISA | CISA adds CVE-2026-25108 after FileZen file server exploit |
| Wed 25 Feb · 13:18 UTC | CISA | Soliton FileZen open to OS command injection CVE-2026-25108 |
- Soliton FileZen open to OS command injection CVE-2026-25108CISA · official notice
- CISA adds CVE-2026-25108 after FileZen file server exploitCISA · official notice
- CISA orders patch for FileZen file transfer flaw CVE-2026-25108Security Affairs
- CISA warns FileZen file server CVE-2026-25108 is being exploitedThe Hacker News · first in our coverage