CVE-2025-37164

Description

A remote code execution issue exists in HPE OneView.

Scoring

• CVSS: 10 (CRITICAL, 3.1)
• EPSS exploitation probability: Not yet available
• EPSS percentile: Not yet available

CISA KEV status

• Added to KEV: 2026-01-07
• Remediation due date: 2026-01-28
• Known ransomware campaign use: Unknown

Weakness types (CWE)

• CWE-94

References

• https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US
• https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/hpe_oneview_rce.rb
• https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US#vulnerability-summary-1
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-37164

More from Hewlett Packard Enterprise (HPE)

• No other tracked CVEs for this vendor yet.