What happened
Attackers are exploiting a command injection flaw in Array Networks’ ArrayOS AG VPN to install webshells on vulnerable devices.
Who is affected
Organizations that use ArrayOS AG VPN appliances and have not applied the most recent security update.
Why CISOs should care
The flaw is under active exploitation. Once attackers plant a webshell, they gain persistent remote access to the device. This access can be used for lateral movement, data theft, or staging further attacks. Since VPN appliances sit at the network edge, a breach can weaken core security controls.
3 practical actions
-
Patch all ArrayOS AG VPN appliances to the latest version.
-
Review logs and file systems for webshells or unusual activity.
-
Isolate VPN appliances from sensitive systems and enforce strict access policies.
