CVE-2025-66644: Array Networks ArrayOS AG OS Command Injection Vulnerability

Q: How do I fix CVE-2025-66644?

arrayos ag: upgrade to 9.4.5.9. Exact commands for each OS are on this page.

Q: Is CVE-2025-66644 being exploited?

Yes. CVE-2025-66644 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

Q: What does CVE-2025-66644 affect?

CVE-2025-66644 affects arrayos ag. Severity is high (CVSS 7.2). Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.

Q: How urgent is CVE-2025-66644?

Priority 72/100. High severity; Exploited in the wild (CISA KEV)

Patch now

HIGH 7.2EXPLOITEDUPGRADE

CVE-2025-66644 is a high-severity flaw (CVSS 7.2) affecting arrayos ag, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.

Why this priority

High severity
Exploited in the wild (CISA KEV)

A fixed release or distro patch exists.

Risk facts

CVSS score	7.2 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	High
User interaction	None
EPSS exploit chance	3.4% (top 11%)
CISA exploited list	Yes, fix due 2025-12-29
Weakness	CWE-78
Published	2025-12-05
Last modified	2026-06-17

Publisher (CNA): MITRE · Vendor: arraynetworks

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2025-12-05 19:15 UTCPublished CVE record published
2025-12-08Exploited Added to the CISA Known Exploited Vulnerabilities list
2025-12-29Deadline CISA due date for US federal agencies to patch
2026-06-17 09:57 UTCUpdated Record last modified

arraynetworks arrayos ag UPGRADE

Affected: < 9.4.5.9

Fixed in: 9.4.5.9

Safe to downgrade to: no unaffected older release

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

Exact fixes by distribution

Fedora 46 · legofy · FIXED · 1.0.0-43.20261028git6913585.fc46 · FEDORA-2026-e1e60e1e32 · source

sudo dnf upgrade --advisory=FEDORA-2026-e1e60e1e32

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Write-up: www.bleepingcomputer.com/news/security/hackers-are-exploiting-arrayos-ag-vpn-flaw-to-plant

Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2025-66644?

arrayos ag: upgrade to 9.4.5.9. Exact commands for each OS are on this page.

Is CVE-2025-66644 being exploited?

Yes. CVE-2025-66644 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

What does CVE-2025-66644 affect?

CVE-2025-66644 affects arrayos ag. Severity is high (CVSS 7.2). Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.

How urgent is CVE-2025-66644?

Priority 72/100. High severity; Exploited in the wild (CISA KEV)

Related CVEs

CVE-2023-51707 CRITICAL 9.8 UPGRADE MotionPro in Array ArrayOS AG before 9.4.0.505 on AG and vxAG allows remote command execution via crafted pack

References

← Back to latest CVEs