Is CVE-2026-25108 (Soliton Systems K.K FileZen OS Command Injection) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2026-25108 to its Known Exploited Vulnerabilities catalogue on 24 February 2026, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Soliton Systems K.K FileZen contains an OS command injection vulnerability when an user logs-in to the affected product and sends a specially crafted HTTP request.

What “exploited in the wild” means for CVE-2026-25108

The practical signal here is not the vulnerability label alone, but CISA’s decision to place it in the Known Exploited Vulnerabilities catalogue. For responders, that means you should treat this as an active exploitation issue, not a theoretical weakness. The key question becomes whether FileZen is in your environment, whether exposed instances exist, and whether any internet-facing or externally reachable deployment can be reached by the affected request path.

Because the vulnerability is an OS command injection issue triggered after login and a specially crafted HTTP request, exposure is about more than simple version awareness. You need to know whether the product is reachable, whether authenticated users exist who could send the request, and whether logs or telemetry show suspicious request patterns around the login and request-handling flow.

How to confirm exposure and reduce immediate attack surface

Start by identifying every FileZen instance, then determine which ones are reachable from untrusted networks or from user populations you do not fully trust. If the product is externally exposed, the operational priority is to reduce that exposure quickly while you validate patch status and vendor guidance. The CISA KEV entry is a strong triage trigger, and the authoritative product, vulnerability, and catalogue references are best checked through the CVE Program, the CISA Known Exploited Vulnerabilities Catalog, and the vendor advisory.

If patching is not immediate, narrow access to the minimum set of users and hosts that truly need the service. That includes reviewing reverse proxies, firewall rules, VPN exposure, administrative interfaces, and any web-facing paths that can reach the vulnerable request handler. If you operate compensating controls, confirm that they actually block malicious request construction rather than only filtering obvious payload patterns.

What to look for if you suspect exploitation

For a command injection issue, investigation should focus on both request traces and host-level side effects. Review authentication events, unusual HTTP requests immediately after login, command-line process creation, new child processes from the FileZen service, unexpected file writes, outbound connections, and any evidence that the appliance or server executed commands it normally would not run.

Also check whether attackers may have used the weakness to establish persistence, stage additional tooling, or harvest data after gaining command execution. If you see signs of post-exploitation activity, widen the review to neighbouring systems, because a successful command injection on a file-handling platform often becomes a foothold for lateral movement or data access beyond the initial host.

Risk and Threat Considerations

Command injection is dangerous because it can convert a web request into operating system execution, which collapses the separation between application input and host control. When the product is internet-facing or widely accessible, the attacker’s barrier is often just a valid login path and a reachable endpoint.

Failure mechanism: The vulnerable application accepts crafted HTTP input and passes it into an OS command context, allowing attacker-controlled arguments or command fragments to execute on the host.

Impact: Successful exploitation can lead to arbitrary command execution, data exposure, service disruption, persistence, and further compromise of adjacent systems if the host has useful credentials or network reach.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5, OWASP ASVS and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed exploitation makes rapid identification and remediation central to this CVE.
Recommendation — Prioritise and verify remediation for exposed FileZen instances before routine backlog work.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	This CVE needs exposure confirmation and exploit-aware monitoring of affected assets.
Recommendation — Scan for FileZen exposure and track remediation status on every deployed instance.
OWASP ASVS	V15 — Secure Coding and Architecture	OS command injection is an input-to-execution design failure addressed by secure architecture controls.
Recommendation — Review request handling paths that can translate user input into operating system commands.
MITRE ATT&CK	T1059 — Command and Scripting Interpreter	The vulnerability enables command execution on the target host, matching this ATT&CK technique.
Recommendation — Hunt for unexpected command execution and related child processes on affected hosts.
NIST CSF 2.0	DE.CM-09 — Monitoring for Unauthorized Personnel, Connections, Devices, and Software	Active exploitation calls for detection of suspicious access, connections, and software behaviour.
Recommendation — Monitor FileZen logs and host telemetry for anomalous post-login activity and spawned processes.

Practitioner Guidance

What to prioritise: Treat KEV-listed exploitation as a live exposure-management problem, not a routine patch queue item. Prioritise internet-facing instances, administrative interfaces, and deployments that handle sensitive documents or have privileged network paths.

What to verify: Confirm whether FileZen is present, whether the vulnerable request path is reachable, and whether logs show anomalous post-login HTTP requests, unexpected process spawning, or outbound activity that does not fit normal application behaviour.

Decision rule: If you cannot patch immediately, reduce reachability first, then validate whether the service can be safely isolated without breaking business use. If you find evidence of exploitation, treat it as a host compromise and investigate for persistence and data access before restoring normal trust.

Practitioner takeaway: The KEV listing should move this issue into active incident-style handling, because the main danger is not just vulnerable code, but the possibility that someone has already used it to turn a login-bearing web request into host execution.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org