Description
Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Array Networks ArrayOS AG
Default version status: unaffected
0 to < 9.4.5.9affected
References
- https://www.jpcert.or.jp/at/2025/at250024.html ↗
- https://x.com/ArraySupport/status/1921373397533032590 ↗
- https://www.bleepingcomputer.com/news/security/hackers-are-exploiting-arrayos-ag-vpn-flaw-to-plant-webshells/ ↗
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-66644 ↗