CVE-2025-66644

Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.

High7.2Known exploitedEPSS 3.3%

Published: 5 Dec 2025
Updated: 26 Feb 2026
Reserved: 5 Dec 2025
Assigned by: mitre

Description

Exploited in the wild

CISA lists this vulnerability in its Known Exploited Vulnerabilities catalog as Array Networks ArrayOS AG OS Command Injection Vulnerability.

Added: 8 Dec 2025
Fix due (US federal): 29 Dec 2025
Used by ransomware: Not known

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Scores

CVSS scores of CVE-2025-66644, by who scored it
Scored by	CVSS	Score	Vector
mitreCNA (assigner)	3.1	High7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Analyzed	3.1	Critical9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 3.3% · top 11% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: active · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.2.

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (opens in a new tab)All about CWE-78 and its CVEs

Affected products

Array Networks · ArrayOS AG
- affected < 9.4.5.9

References (4)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-66644](https://trackcve.app/badge/CVE-2025-66644.svg)](https://trackcve.app/cve/CVE-2025-66644)

Record last updated 26 Feb 2026, 16:57 UTC.