CVE-2025-37164 (CVSS 10.0): Unauthenticated HPE OneView RCE Grants Total Control Over Data Centers

CVE-2025-37164 (CVSS 10.0) is a critical, unauthenticated Remote Code Execution vulnerability in Hewlett Packard Enterprise’s OneView software. According to Hewlett Packard Enterprise (HPE), the flaw permits a remote attacker to execute arbitrary code without logging in, effectively giving them control over the data centre management appliance and potentially the entire data centre.

HPE OneView acts as the automation engine for hybrid cloud environments, managing servers, storage and networking, so a compromise is described as a takeover of the data centre’s “brain.” The vulnerability affects all versions prior to v11.00, and HPE has released an urgent update; administrators are advised to upgrade to v11.00 or later.

For organisations running older versions (v5.20 through v10.20) that cannot upgrade immediately, a security hotfix is available, but it must be reapplied after an appliance upgrade from HPE OneView version 6.60[.]xx to 7.00.00, and should be implemented promptly given that a CVSS 10 vulnerability is often prioritised by ransomware groups and state-sponsored actors.