Hewlett Packard Enterprise (HPE) — known exploited vulnerabilities
The CISA Known Exploited Vulnerabilities catalog (KEV) lists vulnerabilities that CISA has confirmed are being exploited in the wild; U.S. federal civilian agencies are required to remediate each entry by its due date. This page joins the KEV entries for Hewlett Packard Enterprise (HPE) with NVD CVSS scores and CISA's ransomware-campaign flag. See our methodology or browse all CVEs.
Key findings
CISA's Known Exploited Vulnerabilities catalog lists 1 Hewlett Packard Enterprise (HPE) vulnerability confirmed as exploited in the wild across 1 product; none is currently flagged as used in known ransomware campaigns. All entries affect a single product: OneView. CISA added 1 entry in 2026 so far, compared with 0 in 2025. Across the 1 entry with an NVD CVSS score (100% of the total), the average score is 10.0; 1 entry is rated critical by NVD. The most recent addition is CVE-2025-37164 (Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability), added on 2026-01-07.
Affected products
| Product | Entries | Share |
|---|---|---|
| OneView | 1 | 100% |
Entries added per year
By date added to the KEV catalog
Exploited Hewlett Packard Enterprise (HPE) vulnerabilities (1)
Newest first. CVSS scores from NVD where available.
| CVE | Product | Vulnerability | Date added | Ransomware | CVSS |
|---|---|---|---|---|---|
| CVE-2025-37164 | OneView | Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability | 2026-01-07 | — | CRITICAL10.0 |
Source: CISA Known Exploited Vulnerabilities catalog, joined with NIST NVD CVSS data. Vendor names are normalized across spellings. Compare all vendors.