Actively exploited in the wild
Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability
Hewlett Packard Enterprise (HPE) - OneView · Listed in the CISA KEV since 2026-01-07. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-37164
CriticalCVSS 10.0KEVSummary
A remote code execution issue exists in HPE OneView.
Risk Assessment
An attacker could exploit this to execute arbitrary code on HPE OneView, potentially leading to full compromise of the managed infrastructure.
Recommendation
Apply patches provided by HPE and restrict access to OneView to trusted administrators only.
Other vulnerabilities in HPE OneView
See all- CVE-2026-76720Medium
A vulnerability in HPE OneView can be remotely exploited to cause a URL redirect. No further technical details are provided in the description.
- CVE-2026-76719High
A security vulnerability in HPE OneView may be exploited remotely to perform session hijacking, data theft, or other unauthorized actions.
- CVE-2026-76718High
A potential security vulnerability in HPE OneView can be exploited to allow remote session hijacking or other unauthorized actions.
Original NVD description (English source)
A remote code execution issue exists in HPE OneView.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS