CVE Intelligence

Arraynetworks vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Arraynetworks products: 2 record(s), with severity, exploitation and fixes.

Arrayos Ag 2

Exploited only (KEV) →

CVE-2025-66644 Critical · 9.8 KEV High · 58 CWE-78 Dec 5, 2025
Array Networks ArrayOS AG OS Command Injection Vulnerability
Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.
CVE-2023-28461 Critical · 9.8 KEV Urgent · 73 Ransomware CWE-287 Mar 15, 2023
Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability
Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated "a new Array AG release with the fix will be available soon."