CVE-2026-25108

Soliton Systems K.K FileZen OS Command Injection Vulnerability

Exploited in attacks High 8.7 Attack chance: 5.2%

What it is

FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a specially crafted HTTP request to execute an arbitrary OS command.

CISA: Soliton Systems K.K FileZen contains an OS command injection vulnerability when an user logs-in to the affected product and sends a specially crafted HTTP request.

What to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: March 17, 2026

Added to the CISA list: February 24, 2026
Published: February 13, 2026
Severity: High 8.7 CVSS 4.0
Chance of attacks in the next 30 days (EPSS): 5.2% in the top 7.5% of all known vulnerabilities
Weakness: CWE-78
More details: NVD · CVE.org · CISA

All references (2)

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.