CVE-2023-28461: Array Networks ArrayOS AG SSL VPN missing authentication allows RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable RCE on an internet-facing SSL VPN, with CVSS 9.8, KEV listing and known ransomware use.

What it is

Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) permit unauthenticated remote code execution. An attacker can browse the filesystem of the SSL VPN gateway via a flags attribute in an HTTP header, then exploit a vulnerable URL. This is a critical pre-auth flaw on an internet-facing VPN gateway, a class of device heavily targeted for initial access.

Impact

An unauthenticated attacker gains remote code execution on the SSL VPN gateway, with high impact to confidentiality, integrity and availability. Full control of the gateway can expose internal network access and credentials handled by the device.

Attack surface

Reached over the network via HTTP requests to the SSL VPN gateway; the CVSS vector (AV:N/PR:N/UI:N) and CWE-306 indicate no authentication and no user interaction are required. The header-based filesystem browsing is the reconnaissance step before triggering the vulnerable URL.

Exploitation

Listed in CISA KEV (added 2024-11-25) with known ransomware campaign use, and EPSS 30-day probability is 0.68 (99.3rd percentile), indicating active exploitation. No public exploit references are included in the record beyond the vendor advisory and KEV entry.

What to do

• Apply the fixed Array AG release from the vendor advisory; the 2023-03-09 notice stated a new release would be available soon, so confirm the current fixed version with Array Networks.
• If no fix can be applied, follow CISA KEV guidance and discontinue use of the affected product.
• Restrict management and VPN portal access to trusted networks or IP allowlists and remove direct internet exposure where feasible.
• Monitor the vendor advisory page for updated mitigation instructions and validate the running firmware version against the fixed release.

Detection

• Inspect HTTP requests to the SSL VPN gateway for unusual or attacker-controlled flags attributes in headers.
• Alert on requests to unexpected or malformed URLs on the gateway that deviate from normal VPN portal traffic.
• Review gateway and web logs for filesystem enumeration patterns or anomalous access preceding exploitation attempts.
• Hunt for post-exploitation activity on the gateway host, including unexpected processes, files or outbound connections.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.