CVE-2026-25108
Soliton Systems K.K FileZen OS Command Injection Vulnerability
Published Feb 12, 2026 · updated Jun 17, 2026 · Soliton Systems K.K FileZen
FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a specially crafted HTTP request to execute an arbitrary OS command.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Feb 12, 2026 · Catalog
Detected
FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a specially crafted HTTP request to execute an arbitrary OS command.
Feb 24, 2026 · CISA KEV
Known exploited
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Mar 17, 2026 · CISA KEV
Remediation due
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Jun 17, 2026 · Catalog
Updated
FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a specially crafted HTTP request to execute an arbitrary OS command.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date Mar 17, 2026
Affected
- cpe soliton/filezenversion unspecified
- vendor Soliton Systems K.K FileZenversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2026-25108
Soliton Systems K.K FileZen contains an OS command injection vulnerability when an user logs-in to the affected product and sends a specially crafted HTTP request.
cisa.gov - CVE.orgVulnerability recordCVE-2026-25108
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-25108
30-day exploitation probability 5.2%
first.org - NIST NVDVulnerability recordCVE-2026-25108
FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a specially crafted HTTP request to execute an arbitrary OS command.
nvd.nist.gov