Vulnerability details
CVE-2025-37164
Actively exploited
Hewlett Packard Enterprise (HPE) HPE OneView
CVSS 3.1
10.0Critical
Remedy
Required action (CISA): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. (due: 2026-01-28)
Versions not listed as affected in the CVE record:
- HPE OneView — version 11.00 and later
Official description
A remote code execution issue exists in HPE OneView.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 10.0Critical | 3.1 | CVEProject cvelistV5 (CNA) (hpe) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE OneView | v < 11.00 | CVEProject cvelistV5 (CNA) |
References and advisories
4- https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US
- https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US#vulnerability-summary-1 vendor-advisory
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/hpe_oneview_rce.rb exploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-37164 government-resource
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-12-16
- Last updated
- 2026-02-26
- State
- Published
- Assigner (CNA)
- hpe
- Kolun priority
- 90 · Critical
CISA KEV catalog
- Date added
- 2026-01-07
- Due date
- 2026-01-28
- Used in ransomware
- Unknown
Exploit prediction (EPSS)
90.19%
Probability of exploitation in 30 days
99.7%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Active
- Technical impact
- Total
Weaknesses (CWE)
- CWE-94Improper Control of Generation of Code ('Code Injection')