A command injection vulnerability in Array Networks AG Series secure access gateways has been exploited in the wild since August 2025, according to an alert issued by JPCERT/CC this week.
The vulnerability, which does not have a CVE identifier, was addressed by the company on May 11, 2025. It's rooted in Array's DesktopDirect, a remote desktop access solution that allows users to securely access their work computers from any location.
"Exploitation of this vulnerability could allow attackers to execute arbitrary commands," JPCERT/CC said. "This vulnerability affects systems where the 'DesktopDirect' feature, which provides remote desktop access, is enabled."
The agency said it has confirmed incidents in Japan that have exploited the shortcoming after August 2025 to drop web shells on susceptible devices. The attacks have originated from the IP address "194.233.100[.]138."
There are currently no details available on the scale of the attacks, weaponizing the flaw, and identity of the threat actors exploiting it.
However, an authentication bypass flaw in the same product (CVE-2023-28461, CVSS score: 9.8) was exploited last year by a China-linked cyber espionage group dubbed MirrorFace, which has a history of targeting Japanese organizations since at least 2019. That said, there is no evidence at this stage to suggest that the threat actor could be linked to the latest attack spree.
The vulnerability impacts ArrayOS versions 9.4.5.8 and earlier, and has been addressed in version ArrayOS 9.4.5.9. Users are advised to apply the latest updates as soon as possible to mitigate potential threats. In case patching is not an immediate option, it's recommended to disable DesktopDirect services and use URL filtering to deny access to URLs containing a semicolon, JPCERT/CC said.
Flaw Now Tracked as CVE-2025-66644
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday said the command injection vulnerability impacting Array Networks AG Series secure access gateways has been assigned the CVE identifier CVE-2025-66644 (CVSS score: 7.2).
"Array Networks ArrayOS AG contains an OS command injection vulnerability that could allow an attacker to execute arbitrary commands," the agency said.
The vulnerability has been added to the Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the necessary fixes by December 29, 2025.
(The story was updated after publication on December 9, 2025, with details of the CVE.)
