FileZen Under Active Attack: Command Injection Flaw Gives Hackers Full System Control

Notably, Soliton's cloud-based offering, FileZen S, is explicitly not affected by this vulnerability. The issue is confined to on-premises deployments of the traditional FileZen appliance.

Understanding the Vulnerability

At its core, CVE-2026-25108 is a textbook case of CWE-78: Improper Neutralization of Special Elements Used in an OS Command ("OS Command Injection"). The server-side code in the FileZen web management interface takes user-supplied input from a post-login web form and concatenates it directly into a system command line without performing any input validation, sanitization, or escaping. When the operating system shell interprets this concatenated string, any injected command metacharacters — such as ;, &&, `, or | — are treated as command separators or execution operators, allowing arbitrary commands to run with the privileges of the FileZen service process.

The vulnerability is only reachable when the optional "FileZen Antivirus Check" feature is enabled. This feature, which requires a BitDefender license, appears to invoke a system-level command to perform antivirus scanning on uploaded files. It is in this invocation path that the unsanitized input is passed to the OS shell.

Attack Chain

Based on the consolidated analysis of the Soliton vendor advisory and the JVN entry, the exploitation follows this sequence:

1. Credential acquisition: The attacker obtains valid FileZen user credentials. The exact method is unknown — possibilities include brute-force attacks against the login interface, credential stuffing from previously leaked credential databases, or targeted phishing campaigns against FileZen administrators.
2. Authentication: The attacker logs in to the FileZen web management interface using the stolen or guessed credentials.
3. Precondition verification: The attacker confirms (or ensures) that the "FileZen Antivirus Check" option is enabled on the target appliance. This is the gate that makes the vulnerable code path reachable.
4. Payload injection: The attacker navigates to the post-login web page containing the vulnerable input field and submits a specially crafted HTTP POST request. The payload contains OS command injection metacharacters and the desired malicious command — for example, a reverse shell command or a file exfiltration script.
5. Command execution: The FileZen server concatenates the attacker's input into a system command string and passes it to the OS shell. The injected command executes with the privileges of the FileZen service, achieving full remote code execution on the host.

Because the command runs at the OS level, the attacker can do anything the FileZen service account can do — read, modify, or delete files; download and execute additional tools; establish persistent backdoor access; or pivot laterally into other systems on the network.

CVSS Scoring

The vulnerability has been assessed with the following severity metrics:

• CVSS v3.0: 8.8 (HIGH) — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• CVSS v4.0: 8.7 (HIGH) — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

The key takeaway from the CVSS vector is that while authentication is required (PR:L), the attack complexity is low (AC:L), no user interaction is needed (UI:N), and the impact to confidentiality, integrity, and availability is all rated HIGH. The CISA ADP Vulnrichment assessment confirms the technical impact is "total" — meaning complete compromise of the affected system.

Who Is Affected

FileZen is a file-sharing and file-transfer appliance manufactured by Soliton Systems, a Japanese IT security company. The product is widely used across Japanese enterprises, government agencies, and educational institutions to facilitate secure file exchanges. Organizations that have the optional BitDefender-powered "Antivirus Check" feature enabled are at direct risk, though the prevalence of this configuration across deployed environments is currently unknown.

Any organization running FileZen versions within the affected range (V4.2.1 through V4.2.8 or V5.0.0 through V5.0.10) should treat this as a high-priority patching event, regardless of whether they believe the Antivirus Check feature is enabled — configuration drift and undocumented changes are common in production environments.

Real-World Risk

Active Exploitation Confirmed

Both the Soliton vendor advisory and the JVN coordination entry confirm that exploitation of CVE-2026-25108 has been observed in the wild, with the first reports received by JPCERT/CC on or around February 13, 2026. No specific threat actor group has been attributed to the attacks, and no named campaigns have been publicly linked to the exploitation. The attackers are described simply as "unattributed remote attackers" in the JPCERT/CC reports.

It is worth noting that the CISA ADP assessment, timestamped February 13, 2026, lists exploitation as "none" — which may reflect a lag in CISA's own telemetry relative to the Japanese CERT's observations. Defenders should give greater weight to the JPCERT/CC confirmation and assume active exploitation is ongoing.

What Attackers Can Do

Once an attacker achieves OS command execution on the FileZen host, the consequences are severe:

• Data exfiltration: All files stored on or processed by the FileZen appliance — which may include sensitive business documents, contracts, personal data, and intellectual property — can be stolen.
• Credential harvesting: Credentials cached on the appliance, including those used for integration with directory services or other internal systems, can be extracted and used for lateral movement.
• Ransomware deployment: The compromised appliance can serve as a beachhead for deploying ransomware across the organization's internal network.
• Persistent backdoor access: Attackers can install persistent access mechanisms (web shells, SSH keys, cron jobs) to maintain access even after the initial vulnerability is patched.
• Lateral movement: The FileZen appliance, by nature of its role as a file-transfer system, often has network connectivity to multiple internal segments, making it an ideal pivot point for deeper network penetration.

No Public PoC — But Don't Be Comforted

As of this writing, no public proof-of-concept (PoC) exploit code has been released. The exact format of the injection payload has not been disclosed. However, the absence of a public PoC should not provide false comfort — command injection vulnerabilities of this type are typically straightforward to exploit once the vulnerable parameter is identified, and the confirmation of in-the-wild exploitation demonstrates that attackers have already developed working exploits.

What You Should Do

If your organization runs Soliton FileZen, here are the steps you should take immediately, in order of priority:

1. Patch Immediately

Upgrade all FileZen installations to version V5.0.11 or later. The patch has been available since January 13, 2026, and there is no reason to delay. The vendor advisory and patch can be found at:

• https://www.soliton.co.jp/support/2026/006657.html (https://www.soliton.co.jp/support/2026/006657.html)

2. If You Cannot Patch Right Now, Apply the Workaround

If immediate patching is not feasible due to change management constraints or other operational reasons, disable the "FileZen Antivirus Check" option in the product configuration. This removes the vulnerable code path and prevents exploitation. Be aware that this workaround has a side effect: antivirus scanning of files processed by FileZen will be disabled, reducing your protection against malware uploaded through the system. This should be treated as a temporary measure only — patching remains the definitive fix.

3. Rotate All Credentials

Rotate all credentials used to access the FileZen web management interface. This includes administrator accounts, service accounts, and any user accounts. If your FileZen deployment integrates with Active Directory or LDAP, review those credentials as well. Given that the exploitation requires valid credentials, credential compromise may have been the initial attack vector.

4. Enforce Multi-Factor Authentication

If your FileZen deployment supports multi-factor authentication (MFA), enable it for all accounts immediately. This significantly raises the bar for attackers who have obtained passwords but do not have access to the second factor.

5. Hunt for Indicators of Compromise

Review your FileZen logs and system state for signs of compromise:

• HTTP request logs: Look for POST requests to FileZen web endpoints containing shell metacharacters such as ;, &&, ` (backticks), or | in parameter values.
• System command execution logs: Look for evidence of unexpected commands being executed, particularly invocations of /bin/sh, /bin/bash, cmd.exe, or other shell interpreters triggered by web UI actions.
• File system anomalies: Check for new, unexpected files or binaries in the FileZen installation directory or temporary directories.
• Network anomalies: Monitor for outbound connections from the FileZen appliance to unfamiliar external IP addresses or domains, which could indicate command-and-control communication or data exfiltration.

6. Implement Network Segmentation

Limit network exposure of the FileZen management interface. The web UI should not be directly accessible from the public internet if at all possible. Place the appliance behind a VPN or restrict access to trusted management networks.

7. Conduct a Full Security Audit

If you find any evidence that your FileZen appliance has been compromised, conduct a full security audit of all systems that communicated with it. Assume that any credentials stored on or passing through the appliance may have been harvested, and treat connected systems as potentially compromised until proven otherwise.

The Bigger Picture

This is not the first time FileZen has found itself in attackers' crosshairs. Soliton's file-transfer appliance has historically been targeted in campaigns against Japanese organizations, and file-transfer products as a category have become one of the most frequently exploited classes of enterprise software in recent years. The pattern is familiar: products like MOVEit Transfer, GoAnywhere MFT, and Accellion FTA have all suffered critical vulnerabilities that were rapidly weaponized by ransomware groups and state-sponsored actors. File-transfer appliances sit at a uniquely dangerous intersection — they handle sensitive data, they are often internet-facing, and they frequently run with elevated privileges.

The timeline of CVE-2026-25108 also raises important questions. The patch was released on January 13, 2026, but in-the-wild exploitation was confirmed on February 13 — exactly one month later. This suggests either that attackers reverse-engineered the patch to identify the vulnerability (a well-documented technique known as "patch diffing"), or that exploitation was already occurring before the patch was released and simply wasn't detected until later. Either way, the lesson is clear: when a vendor releases a security update for a network-facing appliance, the clock is already ticking. Every day of delay in applying the patch is a day of exposure to potential compromise.

Organizations that operate FileZen or similar file-transfer appliances should also take this as an opportunity to review their broader appliance security posture. Are all appliances inventoried? Are they on supported firmware versions? Are unnecessary features — like the Antivirus Check option in this case — disabled by default? And critically, are credentials for these systems managed with the same rigor as credentials for any other internet-facing service?

The answers to those questions may determine whether CVE-2026-25108 is a close call or a full-blown breach.