cyfenced.com →

[ CVE-2026-25108 · Published 13 Feb 2026 ]

Soliton Systems K.K FileZen OS Command Injection Vulnerability

Exploited · CISA KEV CVSS 8.8 EPSS 5%No fix listed yet

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2026-02-24

[ Description ]Official description

FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a specially crafted HTTP request to execute an arbitrary OS command.

CISA: Soliton Systems K.K FileZen contains an OS command injection vulnerability when an user logs-in to the affected product and sends a specially crafted HTTP request.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 17 Mar 2026): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References