CVE-2025-66644: Array Networks ArrayOS AG command injection exploited in the wild

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or user interaction required, confirmed in-the-wild exploitation, and a CISA KEV listing with a near-term remediation deadline.

What it is

ArrayOS AG before 9.4.5.9 contains an OS command injection flaw (CWE-78) that is reachable over the network without authentication. It has been exploited in the wild from August through December 2025, and CISA added it to the KEV catalog on 2025-12-08 with a remediation due date of 2025-12-29.

Impact

A remote unauthenticated attacker can execute arbitrary OS commands on the appliance, which press reporting links to webshell deployment on exposed VPN gateways. That gives full compromise of the device with high confidentiality, integrity and availability impact.

Attack surface

Reachable over the network via the CVSS vector AV:N/AC:L/PR:N/UI:N, meaning no authentication and no user interaction are required. The description does not specify the exact interface or parameter, so the precise entry point is not stated in the record.

Exploitation

Active exploitation is confirmed: CISA KEV lists it as exploited in the wild, and press coverage describes webshell planting on ArrayOS AG VPN devices. EPSS 30-day probability is 0.03415 (88.3rd percentile), and no ransomware campaign use is documented.

What to do

• Upgrade ArrayOS AG to 9.4.5.9 or later; this is the only stated fix.
• If patching cannot be completed before the 2025-12-29 KEV due date, apply vendor mitigations or discontinue use of the product per CISA guidance.
• Remove internet exposure of the ArrayOS AG management/VPN interface where operationally possible, and restrict access to trusted networks.
• After patching, treat the appliance as potentially compromised: rotate credentials and certificates and inspect for unauthorized files or accounts.
• Monitor vendor and JPCERT advisories for updated mitigation instructions.

Detection

• Hunt for unexpected webshell files or new scripts in web-accessible directories on ArrayOS AG appliances.
• Review appliance and web logs for command-injection patterns or unusual process execution around the August-December 2025 exploitation window.
• Alert on outbound connections or new listening services from the ArrayOS AG device that do not match baseline behavior.
• Check for unauthorized accounts, scheduled tasks or configuration changes on the appliance.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.