Vendor scorecard
Array Networks
Array Networks security disclosure record — CVE volume, CVSS severity mix and product-category breakdown, sourced from the NIST NVD.
CPE: arraynetworks
Product families
1
Open in latest
2
Inferred — see methodology
Last disclosure
Dec 5, 2025
01
Product categories
1 trackedCVE volume, severity mix and the inferred latest shipping version per category.
| Category | CVEs | Volume | Severity mix | Open | Inferred latest |
|---|---|---|---|---|---|
| ArrayOS / AG (SSL VPN)Application Delivery / ADC · Secure Remote Access / VPNarray_os, arrayos_ag, ssl_vpn_client | 7 | 2 | 3.2.0MED |
Each count is distinct CVEs within that category. A CVE affecting more than one category is counted in each, so these can sum to more than the Array Networks total above.
02
Disclosure trend
12 monthsCumulative CVEs published on or before each month-end over the last 12 months, stacked by CVSS severity. A fixed 12-month window — independent of the date filter above.
- Critical
- High
- Medium
- Low
03
Recent CVEs
7 shownMost recently published, newest first. Each ID links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2025-66644(opens NVD record) | High | 7.2 | Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025. | Dec 5, 2025 |
| CVE-2023-51707(opens NVD record) | Critical | 9.8 | MotionPro in Array ArrayOS AG before 9.4.0.505 on AG and vxAG allows remote command execution via crafted packets. AG and vxAG 9.3.0.259.x are unaffected. | Dec 22, 2023 |
| CVE-2023-41121(opens NVD record) | High | 7.5 | Array AG OS before 9.4.0.499 allows denial of service: remote attackers can cause system service processes to crash through abnormal HTTP operations. | Aug 25, 2023 |
| CVE-2023-28461(opens NVD record) | Critical | 9.8 | Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated "a new Array AG release with the fix will be available soon." | Mar 15, 2023 |
| CVE-2023-28460(opens NVD record) | High | 7.2 | A command injection vulnerability was discovered in Array Networks APV products. A remote attacker can send a crafted packet after logging into the affected appliance as an administrator, resulting in arbitrary shell code execution. This is fixed in 8.6.1.262 or newer and 10.4.2.93 or newer. | Mar 15, 2023 |
| CVE-2023-24613(opens NVD record) | Medium | 4.9 | The user interface of Array Networks AG Series and vxAG through 9.4.0.470 could allow a remote attacker to use the gdb tool to overwrite the backend function call stack after accessing the system with administrator privileges. A successful exploit could leverage this vulnerability in the backend binary file that handles the user interface to a cause denial of service attack. This is fixed in AG 9.4.0.481. | Feb 3, 2023 |
| CVE-2022-42897(opens NVD record) | Critical | 9.8 | Array Networks AG/vxAG with ArrayOS AG before 9.4.0.469 allows unauthenticated command injection that leads to privilege escalation and control of the system. NOTE: ArrayOS AG 10.x is unaffected. | Oct 13, 2022 |
7 CVEs · 1 product families