CVE-2025-66644
Array Networks ArrayOS AG OS Command Injection Vulnerability
Published Dec 5, 2025 · updated Jun 17, 2026 · Array Networks ArrayOS AG
Array Networks ArrayOS AG contains an OS command injection vulnerability that could allow an attacker to execute arbitrary commands.
Timeline
Detection, updates, and resolution for this record.
Dec 5, 2025 · Catalog
Detected
Array Networks ArrayOS AG contains an OS command injection vulnerability that could allow an attacker to execute arbitrary commands.
Dec 8, 2025 · CISA KEV
Known exploited
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Dec 29, 2025 · CISA KEV
Remediation due
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Jun 17, 2026 · Catalog
Updated
Array Networks ArrayOS AG contains an OS command injection vulnerability that could allow an attacker to execute arbitrary commands.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date Dec 29, 2025
Affected
- cpe arraynetworks/arrayos agversion unspecified
- vendor Array Networks ArrayOS AGversion unspecified
Sources
- CISA KEVCVE-2025-66644
Array Networks ArrayOS AG contains an OS command injection vulnerability that could allow an attacker to execute arbitrary commands.
cisa.gov - CVE.orgCVE-2025-66644
Official CVE identifier
cve.org - FIRST EPSSCVE-2025-66644
30-day exploitation probability 3.4%
first.org - NIST NVDCVE-2025-66644
Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.
nvd.nist.gov