CVE-2025-66644 - CVE House

Status published High CVE-2025-66644

Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as...

7.2 CVSS

Vulnerability Description

Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-66644

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from Array Networks

View All →

CVE-2014-125121

Array Networks vAPV and vxAG Default Credential Privilege Escalation

Critical 10

Affected Vendor

Array Networks

View all reports →

Affected Software

ArrayOS AG

Vulnerable Versions:

Timeline

Official Publish: December 5th, 2025

Last Modified: February 26th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-78

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

Initial Access

T1059 Command and Scripting Interpreter

Execution

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1005 Data from Local System

Collection

T1041 Exfiltration Over C2 Channel

Exfiltration