CISA Adds FileZen Vulnerability to KEV Catalog: Active Exploitation Confirmed

CISA confirms active exploits of a critical FileZen vulnerability by Soliton Systems. The OS command injection flaw, CVE-2026-25108 (CVSS 9.8), allows remote system takeover. It joins the Known Exploited Vulnerabilities (KEV) Catalog. CISA’s February 24, 2026 alert states: “Federal agencies must remediate within BOD 22-01 timelines due to real-world attacks.”

FileZen handles enterprise file transfers. Attackers inject commands via unvalidated input to the core server. This runs arbitrary OS code, leading to data theft or malware. All unpatched versions suffer.

As of February 26, 2026, Soliton urges updates. No patch version specified in advisories; check vendor site. CISA tracks internet scans for vulnerable instances. Private firms should prioritize too.

Command injection skips auth for deep access. Attackers pivot to networks post-breach. File servers hold sensitive data, amplifying risks.

Federal rules mandate quick fixes. Others follow for best practice.

Vulnerability Overview

Exploitation Risks

Real-world threats grow.

• Internet-exposed FileZen servers scanned daily.
• Leads to ransomware or persistence.
• Pivots to internal assets.
• No auth needed for initial hit.

Remediation Steps

Patch and secure now.

• Apply Soliton updates immediately.
• Scan networks for FileZen instances.
• Use BOD 22-01 timelines (federal).
• Block inbound to port 443 if exposed.
• Monitor logs for injection attempts.

FAQ