HPE Patches Critical Flaw in IT Infrastructure Management Software

Hewlett Packard Enterprise (HPE) this week announced patches for a critical-severity remote code execution flaw in its OneView IT infrastructure management software. Tracked as CVE-2025-37164 (CVSS score of 10), the vulnerability can be exploited without authentication to execute arbitrary code, and updating to version 11.00 or later resolves the bug.

According to HPE, the issue affects all OneView iterations prior to version 11.00, with hotfixes also released for OneView 5.20 to 10.20, though customers are advised to upgrade 6.60[.]xx iterations to 7.00 before applying the patch. HPE also released fixes for three vulnerabilities in dependencies used by the Telco Service Activator platform, tracked as CVE-2025-49146, CVE-2025-55163, and CVE-2025-7962, which impact PgJDBC, Netty, and Jakarta Mail, respectively.

Successful exploitation could lead to authentication bypass, DoS, and CRLF injection, with all Telco Service Activator versions up to 10.3.2 affected and patches included in version 10.3.3; no evidence of active exploits was noted. Written by Ionut Arghire, according to SecurityWeek.