CVE-2025-66644

published 2025-12-05

CVE-2025-66644: Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.

Priority P1 88 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

KEV ITW

Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
array_networks	arrayos_ag	< 9.4.5.9	9.4.5.9
arraynetworks	arrayos_ag	< 9.4.5.9	9.4.5.9

Detection & IOCs extracted from sources · hover to see the quote

• → Array Networks ArrayOS AG OS command injection vulnerability — monitor for unexpected command execution originating from the ArrayOS AG process/service ↗
• → Vulnerability confirmed exploited in the wild between August and December 2025 — treat any ArrayOS AG instance running versions before 9.4.5.9 as actively targeted ↗

• · Vendor advisory and JPCERT advisory should be consulted for specific patch and mitigation guidance; fix is available in ArrayOS AG 9.4.5.9 and later ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vulncheck 7.2 HIGH

cisa 9.8 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78