cve detail

CVE-2025-66644

naam

Array Networks ArrayOS AG OS Command Injection Vulnerability

Array Networks ArrayOS AG contains an OS command injection vulnerability that could allow an attacker to execute arbitrary commands.

KEV

bekend misbruikt

EPSS

1,2%

percentiel

79%

vendor

Array Networks

product

ArrayOS AG

toegevoegd aan KEV

08 dec 2025

due date

29 dec 2025

ransomware

Unknown

CWE

CWE-78

EPSS datum

12 mei 2026

aanbevolen actie

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

notities

https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/ag.html ; https://www.jpcert.or.jp/at/2025/at250024.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-66644