A command injection vulnerability in Array Networks AG Series secure access gateways has been exploited in the wild since August 2025, according to an alert issued by JPCERT/CC this week.
The vulnerability, which does not have a CVE identifier, was addressed by the company on May 11, 2025. It's rooted in Array's DesktopDirect, a remote desktop access solution that allows users to securely access their work computers from any location.
"Exploitation of this vulnerability could allow attackers to execute arbitrary commands," JPCERT/CC said. "This vulnerability affects systems where the 'DesktopDirect' feature, which provides remote desktop access, is enabled."
The agency said it has confirmed incidents in Japan that have exploited the shortcoming after August 2025 to drop web shells on susceptible devices. The attacks have originated from the IP address "194.233.100[.]138."
There are currently no details available on the scale of the attacks, weaponizing the flaw, and identity of the threat actors exploiting it.
However, an authentication bypass flaw in the same product (CVE-2023-28461, 9.8) was exploited last year by a China-linked cyber espionage group dubbed MirrorFace, which has a history of targeting Japanese organizations since at least 2019. That said, there is no evidence to suggest that at this stage the threat actor could be linked to the latest attack spree.
The vulnerability impacts ArrayOS versions 9.4.5.8 and earlier, and has been addressed in version ArrayOS 9.4.5.9. Users are advised to apply the latest updates as soon as possible to mitigate potential threats. In case patching is not an immediate option, it's recommended to disable DesktopDirect services and use URL filtering to deny access to URLs containing a semicolon, JPCERT/CC said.
