FileZen CVE-2026-25108: Exploited OS Command Injection

What to do

1. Log in to each FileZen system administration page and read the version shown at the top.
2. Update every V5 unit to V5.0.11 or later, and migrate V4 units to V5, since V4 receives no more firmware.
3. If a unit ran a vulnerable version with antivirus checking enabled, ask Soliton support for its compromise-check procedure and reset every user password.
4. Restrict administrator and API access by source IP, disable the built-in admin account, and forward system and access logs to an external syslog server, as Soliton's hardening FAQ advises.
5. Review FileZen user accounts for stale, shared or weak-password logins, since one valid account is all the attacker needs.

How to check if you are affected or compromised

• Review the system log for file-monitoring alerts on the system directory, including 'Critical File Changed'; Soliton says tampering may be logged there.
• Check the administrator mailbox for FileZen's emergency alert email (subject in Japanese: suspected attack on FileZen); if found, isolate the unit without shutting it down and contact support.
• Search access logs for user logins from unfamiliar IP addresses or at odd times, especially for accounts that rarely log in.
• Verify boot-partition file timestamps and SHA-256 hashes against the release notes for your version.

What happened#

On February 13, 2026, Soliton Systems disclosed CVE-2026-25108 in FileZen, its file transfer and sharing appliance, which ships in physical and virtual editions. The vendor notice describes OS command injection (CWE-78) in a specific field on the screen users see after logging in. Soliton had already fixed it in V5.0 Update Pack 11 (V5.0.11), released January 13, 2026, and then reported it to JPCERT/CC. JVN#84622767 and the CVE record score it CVSS 4.0 8.7 and CVSS 3.0 8.8. NVD also rates it 8.8.

This was not a quiet fix. Soliton says it has received "one or more" reports of damage from exploitation. JVN states that attacks have been observed. JPCERT/CC's alert adds that affected units were still in use in Japan and warned that attacks could spread once details became public. CISA added the CVE to KEV on February 24, 2026, with a March 17 deadline. The KEV entry follows the vendor's own confirmation, so the timing needs no further explanation. No actor, campaign or payload has been named publicly as of October 23, 2026.

Who is affected#

FileZen V4.2.1 through V4.2.8 and V5.0.0 through V5.0.10. Both of Soliton's conditions must hold. First, the FileZen antivirus check option must be enabled, so customers who never bought the BitDefender license are not affected. Second, the attacker must be able to log in as at least one user, through a leaked credential or a guessed ID and password. FileZen S is not affected. JPCERT/CC notes that firmware for FileZen V4.x is no longer provided, so V4 owners must move to V5.0.11.

Do you really need to act?#

Outside Japan, few readers run FileZen. If you do, take it seriously. The bar is low: any ordinary user account, not an administrator. File-transfer appliances usually face the internet and hold sensitive documents. Soliton says there is no workaround on vulnerable versions when both conditions apply. It also notes that anyone who exploited it already holds a working login, which is why it asks customers to consider resetting all user passwords. Nine months after the fix, the verdict is check exposure. Confirm the version, retire V4, and look for signs of past tampering.

What to do now#

1. Log in to the system administration page of each unit. The version appears at the top.
2. Update V5 units to V5.0.11 or later. Migrate V4 units to V5.
3. If a unit ran a vulnerable version with antivirus checking on, ask Soliton support for its compromise-check procedure and reset every user password.
4. Apply Soliton's hardening FAQ. Restrict administrator, API and relay-agent access by source IP, disable the built-in admin account, and forward system and access logs to an external syslog server. FileZen keeps only one rotation of local logs.

How to tell if you were hit#

Soliton says FileZen cannot directly show that this bug was used. Its file-monitoring feature may still have logged changes to the system directory. Look for Critical File Changed in the system log, and for an emergency email to the administrator titled, in Japanese, "suspected attack on FileZen." If either appears, isolate the unit from the network without shutting it down and contact support. Also review access logs for logins from unfamiliar addresses, and compare boot-partition hashes against your version's release notes.

Timeline#

• Jan 13, 2026 — Soliton releases V5.0.11 with the fix.
• Feb 13, 2026 — Soliton, JVN and JPCERT/CC disclose the bug and confirm exploitation.
• Feb 17, 2026 — Soliton updates its notice.
• Feb 24, 2026 — CISA adds the CVE to KEV.
• Mar 17, 2026 — Federal remediation deadline.

Vulnerability records

• CVE-2026-25108 · KEV 2026-02-24 · FileZen contains an OS command injection vulnerability.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Soliton Systems — [Important] Command injection vulnerability in the FileZen post-logon screen (Japanese) soliton.co.jp
2. JVN — JVN#84622767: FileZen vulnerable to OS command injection jvn.jp
3. JPCERT/CC — JPCERT-AT-2026-0004: Alert on OS command injection vulnerability in FileZen (CVE-2026-25108) (Japanese) jpcert.or.jp
4. CVE record — CVE-2026-25108 cve.org
5. NVD — CVE-2026-25108 nvd.nist.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2026-25108 cisa.gov
7. Soliton FAQ — Settings for using FileZen more securely (Japanese) faq1.soliton.co.jp