CVE-2026-25108KEV · OVERDUECWE-78

Soliton Systems K.K FileZen OS Command Injection Vulnerability

High · published February 13, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.7. It is confirmed in active exploitation. It sits in the 92.5th percentile for exploit probability.

221
days past CISA
deadline
CVSS v4.0
8.7
EPSS
5%
Percentile
92.5
In the wild
Confirmed
What it is

FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a specially crafted HTTP request to execute an arbitrary OS command.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.05249 · 92.5th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-02-13T03:39Z
KEV added
2026-02-24 · due 2026-03-17
EPSS history
Timeline
  • 24 FEB 00:00Z
    Added to CISA KEV — remediate by Mar 17
    kev
  • 13 FEB 03:39Z
    FileZen contains an OS command injection vulnerability
    cvelistv5