CISA KEV Alert: HPE’s Maximum CVSS Score Flaw and a Zombie PowerPoint Bug

CISA has updated its Known Exploited Vulnerabilities (KEV) Catalog with two new entries, including a critical flaw in HPE OneView tracked as CVE-2025-37164, which carries the maximum CVSS score of 10.0 and allows a remote unauthenticated user to perform remote code execution, meaning an attacker needs no credentials to seize control of the management appliance, according to CISA.

HPE has released a security hotfix covering versions 5.20 through 10.20, but the fix is described as fragile and must be reapplied after an appliance upgrade from HPE OneView version 6.60[.]xx to 7.00.00, specifically for HPE Synergy Composer reimages. The KEV list also flags CVE-2009-0556, a vulnerability in Microsoft PowerPoint affecting multiple older Office versions, with evidence suggesting active exploitation linked to the Exploit:Win32/Apptom[.]gen family first seen in the wild in April 2009.

Federal Civilian Executive Branch agencies have a remediation deadline of 28 January 2026 to address these flaws or disconnect affected systems.