{"id":"soliton-filezen-command-injection-feb-2026","category":"patch","status":"closed","title":"Soliton FileZen command-injection flaw CVE-2026-25108 exploited; fix available, product support ended","tldr":"Attackers used a FileZen flaw requiring a valid login and antivirus checking to be enabled. V5.0.11 fixes it, but FileZen support ended in March. Ask IT to verify patching, check for compromise and arrange replacement.","summary":"Soliton FileZen, a file-transfer appliance used by organisations, has a command-injection flaw that lets a logged-in attacker run operating-system commands when its Antivirus Check Option is enabled. Both physical and virtual installations are affected; FileZen S is unaffected. Soliton released the fix in V5.0.11 on 13 January and disclosed the vulnerability on 13 February, reporting at least one attack. CISA listed it as exploited on 24 February; ransomware involvement remains unknown. The affected releases are V4.2.1–V4.2.8 and V5.0.0–V5.0.10. The 4.x branch has no separate fix: JPCERT/CC directs users to V5.0.11. Administrators should also investigate possible compromise and consider changing every user's password if an attack is suspected. By 3 November, FileZen V5.0's listed support period had ended, so organisations also need to arrange replacement.","action":"If your business or family office uses FileZen, ask IT to verify V5.0.11 or later is installed and arrange replacement because support has ended. Ask them to contact Soliton for compromise-checking guidance and consider changing all users' passwords if an attack is suspected.","product":"Soliton FileZen file-transfer appliance","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-25108"],"tags":["soliton","filezen","file-transfer","command-injection","actively-exploited","end-of-life"],"affected":["FileZen V4.2.1–V4.2.8, physical and virtual editions, when Antivirus Check Option is enabled and an attacker can log in","FileZen V5.0.0–V5.0.10, physical and virtual editions, when Antivirus Check Option is enabled and an attacker can log in"],"fixed":["FileZen V5.0.11 and later"],"matches":[],"sources":[{"kind":"advisory","title":"FileZen command-injection vulnerability after login","url":"https://www.soliton.co.jp/support/2026/006657.html","by":"Soliton Systems","date":"2026-02-17"},{"kind":"advisory","title":"JVN#84622767: FileZen vulnerable to OS command injection","url":"https://jvn.jp/en/jp/JVN84622767/","by":"JVN","date":"2026-02-13"},{"kind":"advisory","title":"Alert regarding OS command injection vulnerability CVE-2026-25108 in FileZen","url":"https://www.jpcert.or.jp/at/2026/at260004.html","by":"JPCERT/CC","date":"2026-02-13"},{"kind":"advisory","title":"Known Exploited Vulnerabilities catalogue","url":"https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json","by":"CISA","date":"2026-11-03"},{"kind":"advisory","title":"Support information for discontinued products","url":"https://www.soliton.co.jp/support/support_eos_product.html","by":"Soliton Systems","date":"2026-09-16"},{"kind":"news","title":"CISA flags exploited FileZen command injection bug, patch now! (CVE-2026-25108)","url":"https://www.helpnetsecurity.com/2026/02/25/cve-2026-25108-filezen-vulnerability-exploited/","by":"Help Net Security","date":"2026-02-25"}],"started":"2026-02-13","closed":"2026-03-31","created":"2026-11-03T22:26:10.855Z","updated":"2026-11-03T22:26:10.855Z","cve_notes":[{"cve":"CVE-2026-25108","name":"OS command injection in FileZen antivirus checking","what":"A command-injection flaw in FileZen's logged-in web interface lets an attacker with a valid user login run operating-system commands when the Antivirus Check Option is enabled.","severity":"high","cvss":8.8}],"timeline":[{"at":"2026-03-31","added":"2026-11-03T22:23:55.101Z","kind":"other","text":"FileZen V5.0 and the ST82 physical and virtual appliances reached their listed limited-support end date. The available vulnerability fix does not extend the product's support life.","url":"https://www.soliton.co.jp/support/support_eos_product.html","by":"Soliton Systems","patch":null},{"at":"2026-02-24","added":"2026-11-03T22:23:55.101Z","kind":"cisa-added","text":"CISA added CVE-2026-25108 to its Known Exploited Vulnerabilities catalogue, setting a 17 March remediation deadline for US federal civilian agencies. Its entry lists ransomware use as unknown.","url":"https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json","by":"CISA","patch":null},{"at":"2026-02-13","added":"2026-11-03T22:23:55.101Z","kind":"disclosed","text":"Soliton and JVN publicly disclosed the flaw, with attacks already observed. Affected versions are V4.2.1–V4.2.8 and V5.0.0–V5.0.10; FileZen S is unaffected.","url":"https://jvn.jp/en/jp/JVN84622767/","by":"JVN","patch":null},{"at":"2026-01-13","added":"2026-11-03T22:23:55.101Z","kind":"new-fix","text":"Soliton released FileZen V5.0.11, fixing the command-injection flaw later assigned CVE-2026-25108.","url":"https://www.soliton.co.jp/support/2026/006657.html","by":"Soliton Systems","patch":"patched"}],"url":"https://hard.fyi/live/soliton-filezen-command-injection-feb-2026/","json":"https://hard.fyi/api/live?id=soliton-filezen-command-injection-feb-2026"}