FileZen file-transfer appliance contains an OS command injection vulnerability…

12 February 2026 critical vulnerability

FileZen file-transfer appliance contains an OS command injection vulnerability (CVE-2026-25108) being actively exploited; immediate patching required.

Japan's IPA has disclosed a critical OS command injection vulnerability in Soliton Systems' FileZen, a file-transfer appliance widely deployed in Japanese enterprises. The vulnerability allows authenticated users to execute arbitrary OS commands by sending crafted HTTP requests to the appliance. The developer has confirmed active exploitation in the wild, making this an urgent patching priority for organisations running affected versions.

Affected versions include FileZen V5.0.0 through V5.0.10 and V4.2.1 through V4.2.8. FileZen S is not impacted. The vulnerability carries a CVSS v3 score of 8.8, classified as critical by IPA. Soliton Systems has released patches and urges immediate deployment.

Given confirmed exploitation and the appliance's typical placement on network perimeters for external file sharing, this represents a significant risk for initial access. Organisations should prioritise patching, review logs for anomalous command execution, and consider temporary access restrictions until updates are applied.

Mentioned in this report

Vulnerabilities CVE-2026-25108KEV

Detection guidance

Suspicious Shell Spawned by FileZen Web Process (Command Injection)

ATT&CK T1190

Detects a shell interpreter spawned as a child of the FileZen appliance's web/application process, consistent with exploitation of the OS command injection vulnerability (CVE-2024 FileZen). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Shell Spawned by FileZen Web Process
id: bdd34bb6-9857-5a4c-9a28-182d7d46eebe
status: experimental
description: Detects a shell (sh/bash) or command interpreter launched as a child
  of a Java or HTTP server process typical of the FileZen appliance, indicating possible
  exploitation of the OS command injection vulnerability disclosed by IPA.
references:
- https://www.ipa.go.jp/
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - /java
    - /tomcat
    - httpd
    - nginx
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cli:
    CommandLine|contains:
    - '-c '
    - '&&'
    - '|'
    - ;
  condition: selection_parent and selection_child and selection_cli
falsepositives:
- Legitimate administrative scripts invoked by the appliance's built-in maintenance
  tasks
- Backup or monitoring agents that legitimately shell out from the web application
  process
level: high
tags:
- attack.t1190
- attack.t1059
author: Vorant

Reconnaissance Commands Executed via Web Application Process (Post Command Injection)

ATT&CK T1059

Detects common reconnaissance or enumeration commands (whoami, id, uname, cat /etc/passwd) executed by a child process of a web-facing application, indicative of post-exploitation activity following OS command injection on an internet-facing appliance such as FileZen. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Recon Commands Executed via Web-Facing Application Process
id: c27a5d1d-b4a9-5943-86df-376d19a17926
status: experimental
description: Detects execution of typical reconnaissance commands (whoami, id, uname,
  cat /etc/passwd) launched from a web/application server process, consistent with
  exploitation of an OS command injection vulnerability on a perimeter file-transfer
  appliance.
references:
- https://www.ipa.go.jp/
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - /java
    - /tomcat
    - httpd
    - nginx
  selection_cmd:
    CommandLine|contains:
    - whoami
    - 'id '
    - uname
    - /etc/passwd
    - 'wget '
    - 'curl '
  condition: selection_parent and selection_cmd
falsepositives:
- Legitimate health-check or diagnostic scripts executed by the appliance's built-in
  maintenance tools
- Administrator troubleshooting sessions performed via an authorized management shell
  on the same host
level: high
tags:
- attack.t1059
- attack.t1190
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2025/20260213-jvn.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free