CISA Flags Microsoft Office and HPE OneView Bugs as Actively Exploited

CISA on Wednesday added two security flaws affecting Microsoft Office and Hewlett Packard Enterprise (HPE) OneView to its Known Exploited Vulnerabilities (KEV) catalog, according to CISA, with evidence of active exploitation. The vulnerabilities listed are CVE-2009-0556, a code injection flaw in Microsoft Office PowerPoint with a CVSS of 8.8, and CVE-2025-37164, a code injection flaw in HPE OneView with a CVSS of 10.0 that could allow remote code execution by a remote unauthenticated user.

Details of CVE-2025-37164 emerged last month after HPE said the vulnerability affects all versions prior to 11.00, and hotfixes are available for OneView versions 5.20 through 10. The article notes the scope of attacks targeting the two flaws is unclear and there are no public reports of exploitation in the wild, though eSentire reported a PoC exploit for CVE-2025-37164 on 23 December 2025. Federal agencies are urged to apply fixes by 28 January 2026 under Binding Operational Directive 22-01.