JPCERT Confirms Active Command Injection Attacks on Array AG Gateways

According to JPCERT/CC, a command injection vulnerability in Array Networks AG Series secure access gateways has been exploited in the wild since August 2025. The flaw, which does not yet have a CVE identifier, was addressed by Array on 11 May 2025 and stems from DesktopDirect, the remote desktop feature that enables secure access to work computers from anywhere.

Exploitation could allow attackers to execute arbitrary commands on affected systems where DesktopDirect is enabled, with incidents in Japan reportedly dropping web shells after August 2025 from the IP address 194.233.100[.]138. There are currently no details on the scale of the attacks, the weaponisation, or the identity of threat actors involved.

The advisory notes that the vulnerability affects ArrayOS versions 9.4.5.8 and earlier and has been fixed in 9.4.5.9; administrators are urged to patch or, if patching is not possible, disable DesktopDirect and consider URL filtering to deny URLs containing a semicolon.