CVE-2026-25108: Soliton Systems FileZen OS Command Injection (KEV)
CVE-2026-25108 is an OS command injection in Soliton Systems' FileZen secure file-transfer appliance that lets any logged-in user send a crafted HTTP request to run arbitrary OS commands when the product's Antivirus Check Option is enabled, and it is listed in CISA's Known Exploited Vulnerabilities catalog with no available workaround short of upgrading.
Vulnerability summary
| Vulnerability ID | CVE-2026-25108 |
|---|---|
| CVSS score | 8.8 |
| EPSS score | 0.05249 |
| CISA KEV | Yes — in the Known Exploited Vulnerabilities catalog |
| Source | NVD |
| Published | 2026-02-13T04:15:53.410 |
Affected components
| Component | CPE | Version range |
|---|---|---|
| Soliton Systems FileZen | cpe:2.3:a:soliton:filezen:*:*:*:*:*:*:*:* | V4.2.1 through V5.0.10 (fixed in V5.0.11); FileZen S is not affected |
What this means
CVE-2026-25108 (CWE-78, improper neutralization of special elements used in an OS command) affects Soliton Systems K.K's FileZen, a file-transfer appliance used by Japanese enterprises. NVD's description states: "FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a specially crafted HTTP request to execute an arbitrary OS command" (NVD).
NVD's own analysis assigns a CVSS v3.1 Primary score of 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — network-reachable, low complexity, requiring only a low-privilege authenticated session and no user interaction, with high impact to confidentiality, integrity and availability. JPCERT/CC's JVN advisory separately lists an equivalent CVSS v3.0 score of 8.8 and a CVSS v4.0 score of 8.7 (NVD; JVN#84622767).
Soliton's own vendor advisory states the vulnerability affects FileZen versions V4.2.1 through V5.0.10, is fixed in V5.0.11 and later, that FileZen S (a separate product line) is not impacted, and explicitly that "there is no way to avoid this in affected versions" (V4.2.1–5.0.10) other than upgrading — there is no interim workaround or mitigation (Soliton Systems, FileZen security advisory).
CISA added CVE-2026-25108 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-02-24, with a required-action due date of 2026-03-17 (CISA KEV).
As of 2026-10-29, FIRST scores the probability of exploitation at 0.05249 (92.519th percentile) (FIRST EPSS).
Because there is no workaround for affected versions, any FileZen deployment on V4.2.1 through V5.0.10 should be upgraded to V5.0.11 or later immediately; operators who cannot upgrade right away should disable the Antivirus Check Option and restrict administrative/login access to the appliance as an interim risk reduction, though Soliton does not list this as a validated mitigation.
Evidence
- OS command injection in FileZen: when the Antivirus Check Option is enabled, a logged-in user can send a crafted HTTP request to execute an arbitrary OS command. — NVD
- NVD Primary CVSS v3.1 score is 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. — NVD
- Affects FileZen V4.2.1 through V5.0.10; fixed in V5.0.11 and later; FileZen S is not affected; no workaround exists for affected versions. — Soliton Systems, FileZen security advisory
- Added to the CISA Known Exploited Vulnerabilities catalog on 2026-02-24, required-action due date 2026-03-17. — CISA KEV
- EPSS score is 0.05249 (92.519th percentile) as of 2026-10-29. — FIRST EPSS