Hewlett Packard Enterprise (HPE) fixed maximum severity OneView flaw

Hewlett Packard Enterprise (HPE) has fixed a maximum-severity flaw in its OneView software that could allow remote code execution, according to Hewlett Packard Enterprise advisory. The issue is tracked as CVE-2025-37164, with a CVSS score of 10.0, and affects all OneView versions up to v10.20. The advisory notes that an attacker could exploit the vulnerability to execute code remotely with a remote unauthenticated user. It is not clear whether threat actors have already exploited the flaw in the wild.

In June, HPE released security patches for eight vulnerabilities in its StoreOnce backup solution, including ones that could enable remote code execution and authentication bypass, and the company also shipped OneView version 10.00 to remediate known flaws in third-party components such as Apache Tomcat and Apache HTTP Server.