CVE-2023-28461

Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An...

9.8 CriticalIn KEV

Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated "a new Array AG release with the fix will be available soon."

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

68.1%Up 68.0 points since Mar 16, 2023

What each source reports

NVD Score used 9.8

Record: CVE-2023-28461
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-287, CWE-306
Updated: 2026-11-02

CVE List 9.8

Record: CVE-2023-28461
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-306
Updated: 2026-11-02

EUVDEUVD-2023-32140 9.8

Record: EUVD-2023-32140
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-pj35-hgmm-7fgg 9.8

Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An...

Record: GHSA-pj35-hgmm-7fgg
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-287, CWE-306
Updated: 2026-11-02

CISA KEV No score

Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability

Array Networks AG and vxAG ArrayOS contain a missing authentication for critical function vulnerability that allows an attacker to read local files and execute code on the SSL VPN gateway.

Record: CVE-2023-28461
Weakness: CWE-306
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, CISA KEV, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-28461 is a critical vulnerability (CVSS 9.8) in Array Networks Ag/vxag Arrayos, published March 15, 2023. CISA lists it as known to be exploited, since November 25, 2024. EUVD reports exploitation since November 25, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 68.1%, the 99th percentile. No source names a fixed version.