CISA warns of active attacks on HPE OneView and legacy PowerPoint

CISA warns of active exploitation of two vulnerabilities now listed in the Known Exploited Vulnerabilities (KEV) catalog, with a due patch date of 28 January 2026. The first flaw, CVE-2025-37164, affects HPE OneView and has a CVSS score of 10 out of 10, enabling remote code execution, with a patch released on 17 December 2025.

The second issue is a decade‑old PowerPoint vulnerability, CVE-2009-0556, which affects several PowerPoint versions and can allow remote code execution when a user opens a specially crafted file. Proof of Concept code for the HPE OneView vulnerability appeared publicly one day after the patch, underscoring real-world exploitation risk, while the PowerPoint flaw is described as re‑emerging in legacy Office installs and requires user interaction to trigger.

The KEV guidance emphasises prioritising patched vulnerabilities based on live exploitation, and organisations are advised to monitor the KEV catalog, apply updates swiftly where feasible, and use up‑to‑date anti‑malware protection to intercept exploits. according to CISA