FileZen OS command injection under active exploitation

12 February 2026 critical vulnerability

Soliton Systems' FileZen file-transfer appliance contains an OS command injection flaw (CVE-2026-25108) that is being actively exploited by authenticated users.

Japan's IPA has disclosed a critical OS command injection vulnerability (CVE-2026-25108) in FileZen, a file-transfer appliance manufactured by Soliton Systems. The flaw allows authenticated users to execute arbitrary OS commands by sending crafted HTTP requests to the vulnerable system. The vulnerability affects FileZen versions 5.0.0 through 5.0.10 and versions 4.2.1 through 4.2.8; FileZen S is not affected.

The vendor confirms that active exploitation of this vulnerability has already been observed in the wild. Organizations running affected versions are urged to update immediately to the latest patched release provided by Soliton Systems.

With a CVSS v3 score of 8.8, this vulnerability represents a significant threat to organizations using FileZen for secure file transfers, particularly given the confirmed exploitation activity.

Mentioned in this report

Vulnerabilities CVE-2026-25108KEV

Detection guidance

Web Application Process Spawning Shell Interpreter (Possible FileZen CVE-2026-25108 Exploitation)

ATT&CK T1190

Detects a Java/Tomcat/web-server process (as used by FileZen appliance) spawning a shell interpreter, consistent with OS command injection via crafted HTTP request. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Application Process Spawning Shell Interpreter
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /java
    - /catalina.sh
    - /tomcat
    - /httpd
    - /nginx
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /ksh
  filter:
    CommandLine|contains:
    - logrotate
    - healthcheck
  condition: selection and not filter
falsepositives:
- Legitimate administrative scripts invoked by application startup or maintenance
  jobs
- Custom monitoring or backup scripts launched by the application server
level: high
tags:
- attack.t1190
- attack.t1059
id: dfdc60f7-c7de-5284-bceb-f442f30d4d5e
status: experimental
author: Vorant

Command Injection Reconnaissance Commands from Web Application Parent

ATT&CK T1059

Detects common discovery/enumeration commands (id, whoami, uname, cat /etc/passwd) executed with a web-application or Java process as parent, indicative of OS command injection exploitation attempts such as CVE-2026-25108 in FileZen. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Recon Commands Spawned by Web Application Process
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /java
    - /catalina.sh
    - /tomcat
    - /httpd
    - /nginx
  recon_cmds:
    CommandLine|contains:
    - id;
    - whoami
    - uname -a
    - /etc/passwd
    - cat /etc/shadow
  condition: selection and recon_cmds
falsepositives:
- Administrators troubleshooting the appliance directly through an authorized shell
  session
- Automated health-check scripts that legitimately query system identity
level: high
tags:
- attack.t1059
- attack.t1190
id: 7966d697-a8e2-57ad-b04a-bec8bdd9b116
status: experimental
author: Vorant

Outbound Network Connection Initiated by Web Application Process (Possible Post-Exploitation Payload Fetch)

ATT&CK T1059

Detects a Java/web-server process associated with the FileZen appliance initiating outbound network connections to non-standard ports, potentially indicating download of a second-stage payload after command injection exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Application Process Initiating Outbound Connection
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith:
    - /java
    - /catalina.sh
    - /tomcat
  filter_common_ports:
    DestinationPort:
    - 80
    - 443
    - 8080
    - 8443
  condition: selection and not filter_common_ports
falsepositives:
- Legitimate application updates or license-check callbacks made by the appliance
  software
- Integrations with external file storage or notification services on non-standard
  ports
level: medium
tags:
- attack.t1059
- attack.t1190
id: 9c07c6f7-1d6e-5c56-9b0d-d09284b1b110
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2025/20260213-jvn.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free