← CVE catalog

CVE-2023-28461

Critical CVSS 9.8 Known exploited

Published 2023-03-15 · last changed 2026-08-05 · added to CISA KEV 2024-11-25

This one is being exploited in the wild.

CISA added CVE-2023-28461 to the Known Exploited Vulnerabilities catalog on 2024-11-25. Federal agencies are required to remediate it on a deadline. If you have affected machines, this is the class of finding that moves ahead of the rest of the queue.

The fix

We hold no Microsoft remediation data for CVE-2023-28461, which normally means it is not a Windows CVE. For non-Microsoft software the fix is the vendor's own updated release, and the affected versions are listed below.

What it is

Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated "a new Array AG release with the fix will be available soon."

Sources

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H