CVE-2025-37164 Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Ransomware campaigns Not observed so far

Weakness CWE-94

Description

A remote code execution issue exists in HPE OneView.

Affected products and versions

Product	Affected versions	Fixed in
HPE OneView 11.00	earliest → < 11.00	11.00

Other CVEs of HPE OneView

The 11 CVEs of HPE OneView →

CVE-2024-42508 This vulnerability could be exploited, leading to unauthorized disclosure of information to authenticated users 5.5 Medium CVE-2023-30912 A remote code execution issue exists in HPE OneView 7.2 High CVE-2023-30909 A remote authentication bypass issue exists in some OneView APIs 9.8 Critical CVE-2023-30908 A remote authentication bypass issue exists in a OneView API 9.8 Critical