MSRXVulnerabilities / CVE-2025-37164
CVE-2025-37164
Published 2025-12-16 · Analyzed
CVE-2025-37164
Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability
Exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-01-07, with a fix-by date of 2026-01-28. Patch it first.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
10.0 CRITICAL
CVSS 3.1 · CNA · hpe.com
CVSS 3.1 · CNA · hpe.com
90%
chance of exploitation in the next 30 days (EPSS; in the top 1% of all CVEs)
chance of exploitation in the next 30 days (EPSS; in the top 1% of all CVEs)
A remote code execution issue exists in HPE OneView.
Scores
Affected products
- hpe oneview: ≤ 10.20.00
Weakness: CWE-94
4 references (advisories, patches, write-ups)
- https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US · Vendor Advisory
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/hpe_oneview_rce.rb · Exploit
- https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US#vulnerability-summary-1 · Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-37164 · US Government Resource
Sources: NVD, CVE.org, FIRST EPSS. Missing ones did not answer or have no record yet.