⚠️ CISA Known Exploited Vulnerability
Active ThreatThis vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Active exploitation has been observed in the wild. This poses significant risk to federal enterprises and should be prioritized for immediate patching.
CVE-2025-66644
High CISA KEV
Low
Medium
High
Critical
7.2
CVSS Score
Published: Dec 05, 2025
Last Modified: Dec 10, 2025
Vulnerability Description
Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.
CVSS Metrics
Common Vulnerability Scoring System
Vector String:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector
N
Attack Complexity
L
Privileges Required
H
User Interaction
N
Scope
U
Confidentiality
H
Integrity
H
Availability
H
References & Resources
-
https://www.bleepingcomputer.com/news/security/hackers-are-exploiting-arrayos-ag-vpn-flaw-to-plant-webshells/cve@mitre.org Press/Media Coverage
-
https://www.jpcert.or.jp/at/2025/at250024.htmlcve@mitre.org Third Party Advisory
-
https://x.com/ArraySupport/status/1921373397533032590cve@mitre.org Third Party Advisory
-
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-66644134c704f-9b21-4f2e-91b3-4a467353bcc0 US Government Resource
Severity Details
7.2
out of 10.0
High
CISA KEV Status
Active Exploitation
Listed in CISA's Known Exploited Vulnerabilities catalog
Key Information
- Published Date
- December 05, 2025
