Maximum Severity HPE OneView Flaw Exploited in the Wild

According to the Cybersecurity and Infrastructure Security Agency, a maximum-severity vulnerability in HPE’s OneView platform, CVE-2025-37164, has been added to KEV and carries a 10 CVSS score, reflecting the potential for remote code execution. The flaw was first disclosed by HPE on 17 December 2025, with a hotfix released for all versions from 5.20 through 10.20, and OneView’s privileged control plane means attackers gaining RCE could obtain centralised control over an organisation’s infrastructure.

HPE notes that an alert to the vulnerability came from a community member and emphasises that no customer reports of exploitation have been received, while urging immediate patching. Rapid7, quoted by Dark Reading, describes the blast radius as wider than a typical web app bug, and notes that activity exploitation has not yet been observed in the KEV catalog or by Rapid7 itself. Experts continue to stress patching OneView promptly due to the platform’s broad privileges and deep network deployment.