CVE-2025-37164

Hewlett Packard Enterprise (HPE) HPE OneView

Published 16 Dec 2025 · updated 17 Jun 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 7 Jan 2026, with a remediation deadline of 28 Jan 2026 for US federal agencies.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

A remote code execution issue exists in HPE OneView.

References

support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US · Vendor Advisory
github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/hpe_oneview_rce.rb · Exploit
support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US#vulnerability-summary-1 · Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-37164 · US Government Resource