peter bassill · operator
$ cve CVE-2025-66644 JSON

CVE-2025-66644 KEV

7.2
HIGH · CVSS 3.1 · EPSS 3.4% (pctl 88)

Patch first

On CISA KEV — known exploited in the wild, due 2025-12-29.

Description

Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.

Scoring

CVSS7.2 (HIGH, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS3.42% — more likely to be exploited than 88% of all CVEs
WeaknessCWE-78
On CISA KEVyes — remediate by 2025-12-29
Public exploitnone known
Published2025-12-05
Last modified2026-06-17

CISA KEV

NameArray Networks ArrayOS AG OS Command Injection Vulnerability
Added2025-12-08
Due2025-12-29
Vendor / productArray Networks / ArrayOS AG
Ransomware usenone reported

Affected (15)

VendorProduct
arraynetworksag1000
arraynetworksag1000t
arraynetworksag1000v5
arraynetworksag1100
arraynetworksag1100v5
arraynetworksag1150
arraynetworksag1200
arraynetworksag1200v5
arraynetworksag1500
arraynetworksag1500fips
arraynetworksag1500v5
arraynetworksag1600
arraynetworksag1600v5
arraynetworksarrayos ag
arraynetworksvxag

References

→ the Explorer  ·  watch your stack  ·  NVD