ACTIVELY EXPLOITED
CVE-2025-66644: Array Networks ArrayOS AG OS Command Injection Vulnerability
| Vendor | Array Networks |
|---|---|
| Product | ArrayOS AG |
| Actively exploited | Yes |
| Added to CISA KEV | 8 Dec 2025 |
| CISA federal deadline | 29 Dec 2025 |
| Weakness (CWE) | CWE-78 |
Required action (CISA's text)
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description (NVD)
Array Networks ArrayOS AG contains an OS command injection vulnerability that could allow an attacker to execute arbitrary commands.
SOURCES
Other Array Networks flaws
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.