CISA has added a critical OS command injection vulnerability (CVE-2026-25108) in Soliton Systems' FileZen software to its Known Exploited Vulnerabilities catalog due to active exploitation. The flaw allows authenticated users to execute arbitrary commands and affects specific versions of the file transfer product when its Antivirus Check Option is enabled. The vendor advises updating to version 5.0.11 or later and changing all user passwords, while U.S. federal agencies have a remediation deadline of March 17, 2026. The main topics covered are the vulnerability's technical details, affected versions, exploitation conditions, and recommended mitigation steps.