Loading story…
A command injection vulnerability affecting Array Networks AG Series secure access gateways has been actively exploited since at least August 2025. The flaw, which resides in the DesktopDirect remote desktop access feature, allows attackers to execute arbitrary commands on vulnerable devices. JPCERT/CC confirmed that threat actors have leveraged this vulnerability to deploy web shells and create rogue users, with attacks traced to the IP address 194.233.100[.]138. The vulnerability impacts ArrayOS versions 9.4.5.8 and earlier, and was remediated in version 9.4.5.9 released in May 2025. Organizations unable to immediately patch are advised to disable DesktopDirect services and implement URL filtering to block URLs containing a semicolon.
The attacks have primarily targeted organizations in Japan, but scans indicate that over 1,800 ArrayAG instances are exposed globally, with concentrations in China, Japan, and the United States. The lack of a CVE identifier for this vulnerability complicates tracking and patch management. While a previous authentication bypass flaw in the same product was linked to the MirrorFace threat group, there is currently no evidence connecting the latest exploitation activity to any known actor. Enterprises using AG Series gateways are urged to update to the latest firmware and review their exposure, especially if the DesktopDirect feature is enabled.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
Security researchers reported that over 1,800 internet-exposed Array AG devices were potentially vulnerable worldwide, with most located in Asia. The finding highlighted the continued exposure of unpatched systems despite the availability of a fix since May.
JPCERT/CC reported that the Array AG gateway command injection flaw had been actively exploited since August 2025, with activity traced to IP address 194.233.100[.]138. It urged organizations to patch, preserve logs before updating, and use temporary mitigations such as disabling DesktopDirect and filtering malicious URL patterns if patching was not immediately possible.
Threat actors started exploiting the command injection flaw against unpatched Array Networks AG Series gateways in Japan. The attacks involved arbitrary command execution and post-compromise activity such as webshell deployment and unauthorized user creation.
Array Networks released a fix for a command injection vulnerability in the DesktopDirect feature of AG Series secure access gateways with ArrayOS version 9.4.5.9. The flaw affected ArrayOS AG 9.4.5.8 and earlier and did not receive a public CVE identifier.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcethecyberexpress.com
Open sourcesecurityaffairs.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: a command injection flaw in Array Networks ArrayOS AG VPN devices (CVE-2025-66644) and a buffer overflow in D-Link Go-RT-AC750 routers (CVE-2022-37055). The Array Networks vulnerability affects versions before 9.4.5.9 and has been exploited since August 2025, primarily targeting Japanese organizations, allowing attackers to deploy PHP webshells and create rogue user accounts. The D-Link vulnerability impacts end-of-life routers, enabling remote code execution and lateral movement, with no official patches available, prompting recommendations for device retirement and additional mitigations. Federal agencies are mandated under Binding Operational Directive (BOD) 22-01 to remediate these vulnerabilities by specified deadlines, while all organizations are strongly urged to prioritize patching and mitigation efforts. CISA emphasizes the persistent risk posed by vulnerabilities in VPN appliances and legacy routers, recommending immediate action such as patching, isolating affected hardware, and integrating KEV feeds into vulnerability management processes to reduce exposure to active cyber threats.
Jun 29, 2026
A critical command injection vulnerability, tracked as CVE-2026-0625, has been discovered in multiple legacy D-Link DSL gateway routers. The flaw resides in the `dnscfg.cgi` endpoint, where improper input sanitization allows unauthenticated remote attackers to execute arbitrary shell commands via DNS configuration parameters. Security researchers from VulnCheck and The Shadowserver Foundation have confirmed active exploitation attempts, with evidence captured on honeypots and reports of ongoing campaigns targeting affected devices. The impacted models include DSL-526B (≤ 2.01), DSL-2640B (≤ 1.07), DSL-2740R (< 1.17), and DSL-2780B (≤ 1.01.14), all of which have reached end-of-life and will not receive security updates. D-Link has acknowledged the vulnerability and is working to determine if additional products are affected, citing challenges in identifying all impacted models due to firmware variations. The company strongly advises users to retire and replace vulnerable devices, as no patches will be issued. The vulnerability is rated as critical (CVSS 9.3), and exploitation has been observed in the wild, though the specific threat actors and targets remain unclear. The risk is heightened by the unauthenticated nature of the exploit and the widespread use of these legacy routers in consumer environments.
Jun 29, 2026
Multiple maximum-severity vulnerabilities in enterprise infrastructure management products are being **actively exploited**, enabling unauthenticated remote code execution as `root` and creating high-impact initial access paths into data center and security operations environments. Reported exploitation includes mass, automated scanning and rapid weaponization following public disclosure and PoC availability, increasing the likelihood of opportunistic compromise, follow-on payload delivery, and lateral movement in affected networks. Fortinet *FortiSIEM* is reported as under active attack via **CVE-2024-23108**, an unauthenticated command-injection issue in the `phMonitor` component (noted as listening on TCP `8014`) that can yield full system compromise. Separately, Cisco *Secure Email Gateway* / *Secure Email and Web Manager* is reported as exploited via **CVE-2024-20353** (CVSS 10.0), with activity attributed to China-linked **UAT-9686** leveraging the Spam Quarantine interface to gain root execution and deploy custom malware for persistence and evasion. In parallel, Check Point-linked reporting describes **RondoDox** botnet-driven exploitation of HPE *OneView* **CVE-2025-37164** at scale (tens of thousands of attempts observed), consistent with an “exploit-shotgun” approach used to build botnets for DDoS, cryptomining, and secondary payload delivery; the surge coincided with the flaw’s addition to CISA’s known-exploited list.
Jun 29, 2026