NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksClosedUpdated

Soliton FileZen command-injection flaw CVE-2026-25108 exploited; fix available, product support ended

Attackers used a FileZen flaw requiring a valid login and antivirus checking to be enabled. V5.0.11 fixes it, but FileZen support ended in March. Ask IT to verify patching, check for compromise and arrange replacement.

What to do

If your business or family office uses FileZen, ask IT to verify V5.0.11 or later is installed and arrange replacement because support has ended. Ask them to contact Soliton for compromise-checking guidance and consider changing all users' passwords if an attack is suspected.

What’s happening

Soliton FileZen, a file-transfer appliance used by organisations, has a command-injection flaw that lets a logged-in attacker run operating-system commands when its Antivirus Check Option is enabled. Both physical and virtual installations are affected; FileZen S is unaffected. Soliton released the fix in V5.0.11 on 13 January and disclosed the vulnerability on 13 February, reporting at least one attack. CISA listed it as exploited on 24 February; ransomware involvement remains unknown. The affected releases are V4.2.1–V4.2.8 and V5.0.0–V5.0.10. The 4.x branch has no separate fix: JPCERT/CC directs users to V5.0.11. Administrators should also investigate possible compromise and consider changing every user's password if an attack is suspected. By 3 November, FileZen V5.0's listed support period had ended, so organisations also need to arrange replacement.

What
Flaw
Affects
Soliton FileZen file-transfer appliance
Affected
FileZen V4.2.1–V4.2.8, physical and virtual editions, when Antivirus Check Option is enabled and an attacker can log in
FileZen V5.0.0–V5.0.10, physical and virtual editions, when Antivirus Check Option is enabled and an attacker can log in
Fixed in
FileZen V5.0.11 and later
CVE
CVE-2026-25108
Since
13 Feb 2026
Closed
31 Mar 2026

Timeline

  1. Update

    FileZen V5.0 and the ST82 physical and virtual appliances reached their listed limited-support end date. The available vulnerability fix does not extend the product's support life.

  2. CISA added

    CISA added CVE-2026-25108 to its Known Exploited Vulnerabilities catalogue, setting a 17 March remediation deadline for US federal civilian agencies. Its entry lists ransomware use as unknown.

  3. Made public

    Soliton and JVN publicly disclosed the flaw, with attacks already observed. Affected versions are V4.2.1–V4.2.8 and V5.0.0–V5.0.10; FileZen S is unaffected.

  4. New fixFixed

    Soliton released FileZen V5.0.11, fixing the command-injection flaw later assigned CVE-2026-25108.

Sources

  1. FileZen command-injection vulnerability after loginSoliton Systems · 17 Feb 2026
  2. JVN#84622767: FileZen vulnerable to OS command injectionJVN · 13 Feb 2026
  3. Alert regarding OS command injection vulnerability CVE-2026-25108 in FileZenJPCERT/CC · 13 Feb 2026
  4. Known Exploited Vulnerabilities catalogueCISA · 3 Nov 2026
  5. Support information for discontinued productsSoliton Systems · 16 Sept 2026
  6. CISA flags exploited FileZen command injection bug, patch now! (CVE-2026-25108)Help Net Security · 25 Feb 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from February 2026 · JSON · RSS