HPE OneView Flaw Rated CVSS 10.0 Allows Unauthenticated Remote Code Execution

Hewlett Packard Enterprise has resolved a maximum-severity flaw in OneView Software that, if exploited, could enable remote code execution by an unauthenticated user, according to Hewlett Packard Enterprise. The vulnerability is identified as CVE-2025-37164 and carries a CVSS score of 10.0. It affects all OneView versions prior to version 11.00, with a hotfix available for OneView versions 5.20 through 10.20.

The patch notes also indicate that the hotfix must be reapplied after upgrading from version 6.60 or later to version 7.00.00, or after any HPE Synergy Composer reimaging operations; separate hotfixes exist for the OneView virtual appliance and Synergy Composer. While there is no stated exploitation in the wild, users are advised to apply the patches promptly to ensure protection. The article notes this advisory was issued this week and that OneView is designed to centralise IT infrastructure management.