CVE-2025-66644
Published: December 8, 2025
Official Description
Array Networks ArrayOS AG contains an OS command injection vulnerability that could allow an attacker to execute arbitrary commands.
CISA KEV Advisory
Array Networks ArrayOS AG OS Command Injection Vulnerability
Array Networks ArrayOS AG contains an OS command injection vulnerability that could allow an attacker to execute arbitrary commands.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Risk Analysis
This critical OS command injection vulnerability in Array Networks ArrayOS AG allows an unauthenticated, remote attacker to execute arbitrary commands. With a CVSS score of 9.8 and an EPSS score of 0.03060, alongside its presence in CISA's KEV catalog, this is a highly severe and actively exploited flaw. Successful exploitation grants full control over the affected system.
This vulnerability is actively being exploited in the wild, as confirmed by CISA's KEV catalog. It is remotely exploitable without authentication, making it a significant threat.
Immediately apply all available security updates and patches for Array Networks ArrayOS AG. Network segmentation and strict access controls should also be implemented to limit exposure.
Technical Analysis
CVE-2025-66644 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.
CISA has added CVE-2025-66644 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
CVSS v3.1 Vector Breakdown
Exploit & PoC Resources
All References (3)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2025-66644 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1