CVE-2025-66644

9.8 criticalKEVEPSS 3.4%

Critical (9.8) in Array Networks ArrayOS AG. In CISA KEV since 2025-12-08. EPSS 3.4% chance of exploitation in the next 30 days.

Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.

Severity

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 3.4% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
CISA KEV: listed 2025-12-08, due 2025-12-29
CWE: CWE-78
Published: 2025-12-05
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19