CVE-2025-66644: Array Networks ArrayOS AG OS Command Injection Vulnerability

Array Networks ArrayOS AG contains an OS command injection vulnerability tracked as CVE-2025-66644. An attacker who can reach the affected component may be able to execute arbitrary operating-system commands on the appliance.

This class of flaw is serious on network devices because successful exploitation can grant control over traffic inspection, authentication, and connected services. Organizations that rely on Array Networks gateways should treat the issue as a priority for inventory and remediation.

How it works

The weakness is categorized as CWE-78, improper neutralization of special elements used in an OS command. The vulnerable code constructs operating-system commands from untrusted input without adequate escaping or validation.

• An attacker supplies crafted input that alters the intended command string.
• The appliance then executes the modified command under the privileges of the process handling the request.
• No further details on reachable entry points or required authentication are provided in the available summary; confirm specifics against the vendor advisory.

Am I affected? How to find it in your systems

ArrayOS AG runs on Array Networks hardware appliances used for load balancing, VPN, and application delivery. Begin by locating all deployed instances through asset-management records, network discovery, or configuration-management databases.

• Check the software or firmware version string reported by each appliance and compare it against the versions listed in the vendor advisory.
• Review management interfaces, API endpoints, and any externally reachable services that accept user-supplied parameters.
• Monitor logs for unexpected command execution or unusual process spawns originating from ArrayOS processes; exact indicators must be confirmed with the vendor.

How to remediate

Apply the vendor-supplied update referenced in the official advisory. Patching eliminates the root cause and is the primary control.

• After patching, follow any additional hardening steps published by Array Networks for command-handling paths.
• Limit administrative and management access to trusted networks only.
• Ensure the appliance runs with the least privileges required for its role.

If you can't patch immediately

Until a patch can be applied, reduce exposure by following the mitigations prescribed by the vendor. CISA also directs agencies to apply applicable guidance from BOD 22-01 for cloud-connected services or to discontinue use of the product if mitigations are unavailable.

• Segment the management plane so that only authorized jump hosts can reach the appliances.
• Where technically feasible, apply virtual patching or input-filtering rules at an upstream web-application firewall or network device.
• Disable or restrict any non-essential features that accept external input until the update is installed.
• Increase monitoring of authentication events and process creation on the appliances and adjacent systems.

If your data may have been exposed

Command-injection vulnerabilities on network appliances have been used to obtain persistent access and exfiltrate data. Organizations should assume that successful exploitation could result in a breach and review authentication logs and data flows for anomalies. You can run a free exposure scan of your email addresses against known breach data to check for prior incidents involving your domains.