CISA Warns of Active Exploitation of FileZen Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in Soliton Systems’ FileZen software to its Known Exploited Vulnerabilities (KEV) Catalog.

Announced on February 24, 2026, CVE-2026-25108 involves an OS command injection flaw that malicious actors are actively exploiting.

This move underscores the growing threat to enterprise file-sharing systems, urging organizations worldwide to patch immediately.

FileZen, a secure file transfer solution popular in corporate environments, faces severe risks from this vulnerability.

Attackers can inject malicious commands through the web interface, potentially executing arbitrary code on the server.

Such exploits often lead to data breaches, ransomware deployment, or full system compromise.

CISA’s KEV Catalog highlights vulnerabilities with confirmed real-world abuse, prioritizing them under Binding Operational Directive (BOD) 22-01.

Federal agencies must remediate by setting deadlines, but CISA recommends all sectors follow suit to mitigate cyber risks.

Vulnerability Details

CVE-2026-25108 stems from inadequate input sanitization in FileZen’s web components. Threat actors exploit it via crafted requests, bypassing authentication in some scenarios.

This command injection vulnerability scores high on the CVSS scale due to its remote attack potential and lack of user interaction.

Soliton Systems released patches in early 2026, but unpatched systems remain prime targets for advanced persistent threats (APTs) and opportunistic hackers.

Early indicators suggest exploitation in targeted attacks against Japanese firms and U.S. partners using FileZen for secure document exchange.

No specific indicators of compromise (IOCs) have been publicly detailed yet, but security researchers report shellcode execution leading to persistence mechanisms like backdoors.

CVE ID	CVSS Score	Description	Affected Product	Patch Status
CVE-2026-25108	9.1 (High)	OS Command Injection via web interface	Soliton FileZen (versions prior to 7.0.8)	Patch available: Update to 7.0.8 or later

The addition to CISA’s KEV Catalog signals widespread scanning and exploitation attempts. Organizations using FileZen should scan networks for exposed instances, apply patches urgently, and monitor for anomalous command executions.

Enable web application firewalls (WAFs) with command injection rules as an interim defense. BOD 22-01 mandates federal remediation, but private entities face similar dangers from nation-state actors leveraging this flaw in supply chain attacks.

Broader lessons include regular vulnerability scanning and zero-trust segmentation for file servers. CISA’s catalog now lists over 1,000 entries, emphasizing proactive patching. For more, visit the CISA KEV Catalog and CVE-2026-25108 details.

Follow us on Google News, LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google

The post CISA Warns of Active Exploitation of FileZen Vulnerability appeared first on Cyber Security News.