Loading story…
A critical remote code execution vulnerability, identified as CVE-2025-37164 and assigned a maximum CVSS score of 10.0, has been discovered in HPE OneView. The flaw allows unauthenticated attackers to execute arbitrary code remotely, potentially granting them total control over data center infrastructure managed by affected HPE OneView deployments. The vulnerability is remotely exploitable and does not require authentication, significantly increasing the risk to organizations using this management platform.
Security advisories highlight the severity of the issue, noting that exploitation could lead to full compromise of data center environments. While specific affected versions have not yet been detailed, organizations are urged to monitor official HPE communications and apply mitigations or patches as soon as they become available to prevent unauthorized access and potential disruption of critical infrastructure.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
Researchers later published broader exploit tooling for the flaw, including a Metasploit module targeting the vulnerable ID-Pools executeCommand functionality. This made exploitation more accessible to a wider range of attackers.
A proof-of-concept exploit for CVE-2025-37164 was publicly released, showing how the hidden ID Pools API could be abused for unauthenticated remote code execution. Its publication significantly increased the likelihood of real-world exploitation.
Multiple reports stated that, as of disclosure, HPE had not confirmed active exploitation of CVE-2025-37164 in the wild. At the same time, vendors and researchers warned that the flaw's severity and ease of exploitation made urgent remediation necessary.
Rapid7 Labs confirmed the attack vector as the unauthenticated /rest/id-pools/executeCommand endpoint in HPE OneView. The company also released detection capabilities for customers to help identify exploitation attempts.
HPE disclosed CVE-2025-37164, a critical unauthenticated remote code execution flaw in OneView with a CVSS score of 10.0. The company released OneView 11.00 and hotfixes for affected versions, urging customers to patch immediately.
Security researcher Nguyen Quoc Khanh (also referenced as brocked200) responsibly disclosed CVE-2025-37164 to HPE. The disclosure date is explicitly reported as December 16, 2025.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
13 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityonline.info
Open sourceattackerkb.com
Open sourcesocradar.io
Open sourcesecurityonline.info
Open sourcethehackernews.com
Open sourcebleepingcomputer.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical unauthenticated remote code execution vulnerability in HPE OneView, tracked as CVE-2025-37164, is being actively exploited by threat actors. The flaw, which received a maximum CVSS score of 10.0, allows attackers to take full control of affected systems without requiring authentication, leveraging an exposed REST API endpoint within the ID Pools feature. Security researchers, including those at Rapid7, have confirmed that all unpatched versions of HPE OneView for HPE Synergy and virtual machine version 6.x are particularly at risk. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, mandating urgent patching for federal agencies and strongly advising all organizations to update immediately, as no workarounds are available. The vulnerability was originally discovered and reported by Vietnamese security expert Nguyen Quoc Khanh. HPE has released patches to address the issue, but the continued exploitation highlights the urgency for organizations to apply updates. The attack vector involves sending unauthenticated requests to the vulnerable REST API, enabling remote code execution and potentially significant damage to enterprise infrastructure. Security advisories stress that immediate patching is the only effective mitigation, as configuration changes or workarounds do not provide protection against this threat.
Jun 29, 2026
Hewlett Packard Enterprise released security updates for **HPE Networking Instant On Access Points** to fix two vulnerabilities affecting firmware version `3.2.0.1` and earlier. The most severe issue, **`CVE-2025-37103`**, is a critical hard-coded credentials flaw with a **CVSS score of 9.8** that could allow a remote attacker to gain administrative access to the device web interface. HPE documented the issues in security bulletin **`HPESBNW04894`** and urged customers to update affected systems. HPE also patched **`CVE-2025-37102`**, a high-severity vulnerability with a **CVSS score of 7.2** that allows a remote authenticated attacker to inject arbitrary commands into the device console and execute commands on the underlying system. The company recommended immediate upgrades to firmware version `3.2.1.0` or later to reduce the risk of unauthorized access and command execution on exposed access points.
Jul 24, 2026
Hewlett Packard Enterprise released **ALE 5.1.0.0** to fix ten vulnerabilities in HPE Networking Analytics and Location Engine (ALE) 5.0.0.0 and earlier. The most severe, `CVE-2026-76708` (hard-coded default credentials) and `CVE-2026-76709` (privileged arbitrary file write), are remotely exploitable without authentication, carry CVSS 9.8 scores, and could enable full appliance compromise. The ALE advisory also addresses information disclosure, data injection, root-level filesystem and command-execution exposure, man-in-the-middle risk, denial of service, and password-hash disclosure. HPE reported no known public exploit code or active exploitation, but administrators should upgrade immediately and restrict or segment access to ALE management interfaces; a related HPE advisory also identifies a remote denial-of-service vulnerability in Telco Service Orchestrator 5.6.0 and earlier.
Sep 25, 2026