ACTIVELY EXPLOITED
CVE-2023-28461: Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability
| Vendor | Array Networks |
|---|---|
| Product | AG/vxAG ArrayOS |
| Actively exploited | Yes |
| Added to CISA KEV | 25 Nov 2024 |
| CISA federal deadline | 16 Dec 2024 |
| Ransomware use | Known |
| Weakness (CWE) | CWE-306 |
Required action (CISA's text)
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description (NVD)
Array Networks AG and vxAG ArrayOS contain a missing authentication for critical function vulnerability that allows an attacker to read local files and execute code on the SSL VPN gateway.
SOURCES
Other Array Networks flaws
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.