CVE-2025-66644: Array Networks ArrayOS AG DesktopDirect Command Injection (KEV, Exploited)

CVE-2025-66644 is an OS command injection in the DesktopDirect feature of Array Networks ArrayOS AG SSL VPN appliances that lets an attacker execute arbitrary operating-system commands, and NVD's own description confirms it "as exploited in the wild in August through December 2025" — JPCERT/CC separately documents Japan-based attacks that planted webshells and created unauthorized accounts on compromised appliances.

CVE-2025-66644 is an OS command injection (CWE-78) in the DesktopDirect remote-access feature of Array Networks' ArrayOS AG SSL VPN appliance line. NVD's description is unusually direct about active exploitation: "Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025" (NVD).

NVD's own Primary analysis scores it CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, no privileges or user interaction required. A Secondary score submitted by MITRE's CNA assesses it lower, 7.2 (high), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, treating it as requiring high privileges; this page reports NVD's own Primary figure (NVD).

Japan's JPCERT/CC published an alert (AT250024) stating that the DesktopDirect feature in Array AG-series appliances contains a command-injection flaw that lets an attacker run arbitrary commands, that it affects "ArrayOS AG 9.4.5.8 and earlier versions" when DesktopDirect is enabled, and that the fix ships in ArrayOS AG 9.4.5.9. The same alert states that "attacks exploiting this vulnerability have occurred domestically [in Japan] since August 2025, and we have confirmed cases where webshells were installed on the affected product," and recommends disabling DesktopDirect where unused or filtering URLs containing semicolons as an interim measure if patching isn't immediately possible (JPCERT/CC Alert AT250024).

CISA added CVE-2025-66644 to the Known Exploited Vulnerabilities catalog on 2025-12-08, with a required-action due date of 2025-12-29; known ransomware campaign use is recorded as "Unknown" (CISA KEV).

As of 2026-10-29, FIRST scores the probability of exploitation at 0.0342 (88.859th percentile) — notably lower than the CVSS severity would suggest, which is plausible for a vendor appliance with a comparatively small internet-facing install base relative to, say, a mainstream VPN brand (FIRST EPSS).

Operators running ArrayOS AG appliances with DesktopDirect enabled should patch to 9.4.5.9 or later immediately, and should treat any appliance that was internet-facing with DesktopDirect enabled between August and December 2025 as potentially compromised, checking for webshells and unauthorized accounts per JPCERT/CC's guidance before trusting the device again. Array Networks' own support advisory warns that the required restart during patching may cause log loss, so evidence should be preserved first where compromise is suspected.

• Array Networks ArrayOS AG before 9.4.5.9 allows OS command injection in the DesktopDirect feature, confirmed exploited in the wild August through December 2025. — NVD
• NVD Primary CVSS v3.1 score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; MITRE's own CNA submission scores it as a Secondary 7.2 (high), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. — NVD
• Affects ArrayOS AG 9.4.5.8 and earlier with DesktopDirect enabled, fixed in 9.4.5.9; domestic (Japan) attacks since August 2025 installed webshells on affected appliances; recommended interim mitigation is disabling DesktopDirect or blocking URLs containing semicolons. — JPCERT/CC Alert AT250024
• Added to the CISA Known Exploited Vulnerabilities catalog on 2025-12-08, required-action due date 2025-12-29. — CISA KEV
• EPSS score is 0.0342 (88.859th percentile) as of 2026-10-29. — FIRST EPSS