Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.
Affects ArrayOS AG 9.4.5.8 and earlier versions when the DesktopDirect feature is enabled. The fix is in ArrayOS AG 9.4.5.9.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 9.4.5.9
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Array Networks ArrayOS AG, the operating system on Array Networks AG secure access gateway appliances, is affected. An attacker could exploit this flaw to insert and run their own system commands on the device, potentially taking control of it.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
Affected versions
- Array Networks ArrayOS AG
fixed in 9.4.5.9
References 3
jpcert.or.jp
bleepingcomputer.com
Questions about CVE-2025-66644
What does this mean?
The flaw is a command injection bug, which means a crafted input can cause the product to run arbitrary commands. An attacker may be able to run commands on the affected product.Source: jpcert.or.jp
Am I affected, and how do I check?
ArrayOS AG 9.4.5.8 and earlier versions are affected, but only when the DesktopDirect feature is enabled. To check, confirm the installed ArrayOS AG version and whether DesktopDirect is turned on.Source: jpcert.or.jp
What should I do about it?
Upgrade ArrayOS AG to 9.4.5.9 or later, which contains the fix. If an upgrade cannot be done right away, see the workaround for the period without a patch.Source: jpcert.or.jp
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-12-08, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data