CVE-2025-37164

A remote code execution issue exists in HPE OneView.

Score

CVSS 3.1 10.0 Critical

Status

Analyzed - security-alert@hpe.com

Published

2025-12-16

Last modified

2026-02-26

Known exploited (CISA KEV)

since 2026-01-07, action due 2026-01-28: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

CWE-94

Affected products

• Hpe Oneview (Hewlett Packard Enterprise Hpe)
• Oneview (Hpe)

References

• https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US
• https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/hpe_oneview_rce.rb
• https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US#vulnerability-summary-1
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-37164