CVE-2025-37164
Published 2025-12-16 · Updated 2026-06-17 · Source security-alert@hpe.com
Summary
CVE-2025-37164 is a critical-severity (CVSS 10.0) vulnerability in Hewlett Packard Enterprise (HPE) OneView. CISA added it to the Known Exploited Vulnerabilities catalog on January 7, 2026, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by January 28, 2026. CISA does not currently list it as used in ransomware campaigns.
All 1 known-exploited Hewlett Packard Enterprise (HPE) vulnerabilities →Description
A remote code execution issue exists in HPE OneView.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Hewlett Packard Enterprise (HPE) — OneView
Name: Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability
Date added: 2026-01-07 · Due: 2026-01-28
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
References
- https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/hpe_oneview_rce.rb
- https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US#vulnerability-summary-1
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-37164