Critical HPE OneView Vulnerability Exploited in Attacks

The US cybersecurity agency CISA has warned that a maximum-severity code injection flaw in Hewlett Packard Enterprise’s OneView product has been exploited in attacks. Tracked as CVE-2025-37164 (CVSS 10/10), the vulnerability was disclosed on 17 December 2025 when HPE released hotfixes, with HPE crediting Nguyen Quoc Khanh for reporting the bug. “This vulnerability could be exploited, allowing a remote unauthenticated user to perform remote code execution,” according to HPE.

On Wednesday, CISA added the flaw to its Known Exploited Vulnerabilities catalog and noted that it has been exploited in the wild, according to CISA. The agency also cited Rapid7, according to Rapid7, as saying the issue likely impacts a specific REST API endpoint reachable without authentication. CISA’s KEV guidance urges federal and other organisations to identify vulnerable instances and apply mitigations and patches, in line with Binding Operational Directive 22-01.