First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2025-66644

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Array Networks	ArrayOS AG	< 9.4.5.9

References

https://www.bleepingcomputer.com/news/security/hackers-are-exploiting-arrayos-ag-vpn-flaw-to-plant-webshells/Press/Media Coverage
https://www.jpcert.or.jp/at/2025/at250024.htmlThird Party Advisory
https://x.com/ArraySupport/status/1921373397533032590Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-66644US Government Resource

Timeline

Published: Dec 5, 2025
Last modified: Jun 17, 2026
Added to CISA KEV: Dec 8, 2025
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-666457.5NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to directory traversal through the App.add_media_files() fu CVE-2025-666467.5RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other em CVE-2025-666479.8RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other em CVE-2025-666486.1vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to sup CVE-2025-66659.8A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. Affected by this vulnerability i CVE-2025-66662.0A vulnerability was determined in motogadget mo.lock Ignition Lock up to 20251125. Affected by this vulnerability is an unknown functionalit CVE-2025-666601.8Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_CHECK_TA_COMPAT to c CVE-2025-666644.6Insufficient parameter sanitization in AMD Secure Processor (ASP) TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID CVE-2025-66678.8A vulnerability was found in code-projects Car Rental System 1.0 and classified as critical. Affected by this issue is some unknown function CVE-2025-666758.2Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apac CVE-2025-666766.2An issue in IObit Unlocker v1.3.0.11 allows attackers to cause a Denial of Service (DoS) via a crafted request.CVE-2025-666789.8An issue in the HwRwDrv.sys component of Nil Hardware Editor Hardware Read & Write Utility v1.25.11.26 and earlier allows attackers to execu