CVE-2023-28461

Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability

Exploited in attacks Used by ransomware Critical 9.8 Attack chance: 68%

What it is

Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated "a new Array AG release with the fix will be available soon."

CISA: Array Networks AG and vxAG ArrayOS contain a missing authentication for critical function vulnerability that allows an attacker to read local files and execute code on the SSL VPN gateway.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: December 16, 2024

Added to the CISA list: November 25, 2024
Published: March 15, 2023
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 68% in the top 0.7% of all known vulnerabilities
Weakness: CWE-306
More details: NVD · CVE.org · CISA

All references (1)

https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Arra…

More exploited flaws from Array Networks

Added	Vulnerability	Product	Severity	Attack chance
Dec 8, 2025	Array Networks ArrayOS AG OS Command InjectionCVE-2025-66644	ArrayOS AG	High 7.2	3.4%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.