Active exploitation reported of command injection flaw in Array Networks AG Series VPN gateways
Array Networks has patched a critical command injection vulnerability in its Array AG Series secure access gateways that has been actively exploited since August 2025. Attackers are installing PHP webshells and creating unauthorized accounts to gain persistent access to compromised systems. Despite a patch being available since May 2025 (ArrayOS AG version 9.4.5.9), many organizations remain vulnerable.
**If you have Array AG Series access gateways, plan an urgent update to ArrayOS AG version 9.4.5.9. Your devices are actively hacked, and they can't be hidden from the internet. They are designed to be accessible from the Internet. if you can't update right away, disable the DesktopDirect feature or apply URL filtering to stop semicolons in URLs. Check your systems for webshells, unauthorized accounts, or any suspicious activity.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/active-exploitation-reports-in-unpatched-command-injection-flaw-in-array-networks-ag-series-vpn-gateways-c-e-f-f-f/gD2P6Ple2L