FileZen appliance vulnerable to active command injection attacks
FileZen file-transfer appliance contains an OS command injection vulnerability (CVE-2026-25108) being actively exploited; immediate patching required.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-25108 as exploited in the wild.
Japan's IPA has disclosed a critical OS command injection vulnerability in Soliton Systems' FileZen, a file-transfer appliance widely deployed in Japanese enterprises. The vulnerability allows authenticated users to execute arbitrary OS commands by sending crafted HTTP requests to the appliance. The developer has confirmed active exploitation in the wild, making this an urgent patching priority for organisations running affected versions.
Affected versions include FileZen V5.0.0 through V5.0.10 and V4.2.1 through V4.2.8. FileZen S is not impacted. The vulnerability carries a CVSS v3 score of 8.8, classified as critical by IPA. Soliton Systems has released patches and urges immediate deployment.
Given confirmed exploitation and the appliance's typical placement on network perimeters for external file sharing, this represents a significant risk for initial access. Organisations should prioritise patching, review logs for anomalous command execution, and consider temporary access restrictions until updates are applied.
Mentioned in this report
Detection guidance
Suspicious Shell Spawned by FileZen Web Process (Command Injection)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a shell interpreter spawned as a child of the FileZen appliance's web/application process, consistent with exploitation of the OS command injection vulnerability (CVE-2024 FileZen). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Shell Spawned by FileZen Web Process
id: bdd34bb6-9857-5a4c-9a28-182d7d46eebe
status: experimental
description: Detects a shell (sh/bash) or command interpreter launched as a child
of a Java or HTTP server process typical of the FileZen appliance, indicating possible
exploitation of the OS command injection vulnerability disclosed by IPA.
references:
- https://www.ipa.go.jp/
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- /java
- /tomcat
- httpd
- nginx
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
selection_cli:
CommandLine|contains:
- '-c '
- '&&'
- '|'
- ;
condition: selection_parent and selection_child and selection_cli
falsepositives:
- Legitimate administrative scripts invoked by the appliance's built-in maintenance
tasks
- Backup or monitoring agents that legitimately shell out from the web application
process
level: high
tags:
- attack.t1190
- attack.t1059
author: Vorant
Reconnaissance Commands Executed via Web Application Process (Post Command Injection)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects common reconnaissance or enumeration commands (whoami, id, uname, cat /etc/passwd) executed by a child process of a web-facing application, indicative of post-exploitation activity following OS command injection on an internet-facing appliance such as FileZen. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Recon Commands Executed via Web-Facing Application Process
id: c27a5d1d-b4a9-5943-86df-376d19a17926
status: experimental
description: Detects execution of typical reconnaissance commands (whoami, id, uname,
cat /etc/passwd) launched from a web/application server process, consistent with
exploitation of an OS command injection vulnerability on a perimeter file-transfer
appliance.
references:
- https://www.ipa.go.jp/
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- /java
- /tomcat
- httpd
- nginx
selection_cmd:
CommandLine|contains:
- whoami
- 'id '
- uname
- /etc/passwd
- 'wget '
- 'curl '
condition: selection_parent and selection_cmd
falsepositives:
- Legitimate health-check or diagnostic scripts executed by the appliance's built-in
maintenance tools
- Administrator troubleshooting sessions performed via an authorized management shell
on the same host
level: high
tags:
- attack.t1059
- attack.t1190
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2025/20260213-jvn.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs