Loading story…
A critical unauthenticated remote code execution vulnerability in HPE OneView, tracked as CVE-2025-37164, is being actively exploited by threat actors. The flaw, which received a maximum CVSS score of 10.0, allows attackers to take full control of affected systems without requiring authentication, leveraging an exposed REST API endpoint within the ID Pools feature. Security researchers, including those at Rapid7, have confirmed that all unpatched versions of HPE OneView for HPE Synergy and virtual machine version 6.x are particularly at risk. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, mandating urgent patching for federal agencies and strongly advising all organizations to update immediately, as no workarounds are available.
The vulnerability was originally discovered and reported by Vietnamese security expert Nguyen Quoc Khanh. HPE has released patches to address the issue, but the continued exploitation highlights the urgency for organizations to apply updates. The attack vector involves sending unauthenticated requests to the vulnerable REST API, enabling remote code execution and potentially significant damage to enterprise infrastructure. Security advisories stress that immediate patching is the only effective mitigation, as configuration changes or workarounds do not provide protection against this threat.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
A Help Net Security weekly review highlighted CISA's warning that CVE-2025-37164 in HPE OneView is under active exploitation. The item did not add new incident details beyond the KEV listing and exploitation status already disclosed.
CISA added the HPE OneView vulnerability to its Known Exploited Vulnerabilities catalog, indicating the flaw is being actively exploited in the wild. The agency also ordered U.S. federal civilian agencies to patch it under Binding Operational Directive 22-01.
Rapid7 analyzed CVE-2025-37164 and identified an exposed REST API endpoint tied to the ID Pools feature as part of the attack path. The company said HPE OneView for HPE Synergy and OneView 6.x virtual machine deployments were especially likely to be vulnerable.
In mid-December, HPE released a fix for CVE-2025-37164 and advised customers to upgrade to HPE OneView 11.00 or later. HPE said there are no workarounds for the issue.
Vietnamese security researcher Nguyen Quoc Khanh reported CVE-2025-37164, a critical remote unauthenticated code-injection flaw in HPE OneView, to Hewlett Packard Enterprise. The vulnerability affects versions prior to 11.00 and can allow attackers to take control of exposed systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical remote code execution vulnerability, identified as CVE-2025-37164 and assigned a maximum CVSS score of 10.0, has been discovered in HPE OneView. The flaw allows unauthenticated attackers to execute arbitrary code remotely, potentially granting them total control over data center infrastructure managed by affected HPE OneView deployments. The vulnerability is remotely exploitable and does not require authentication, significantly increasing the risk to organizations using this management platform. Security advisories highlight the severity of the issue, noting that exploitation could lead to full compromise of data center environments. While specific affected versions have not yet been detailed, organizations are urged to monitor official HPE communications and apply mitigations or patches as soon as they become available to prevent unauthorized access and potential disruption of critical infrastructure.
Jun 29, 2026
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities—one in HPE OneView (CVE-2025-37164) and another in Microsoft Office PowerPoint (CVE-2009-0556)—to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The HPE OneView flaw, with a maximum CVSS score of 10.0, allows unauthenticated remote code execution on all versions prior to 11.00, and HPE has released patches and hotfixes for affected versions. The PowerPoint vulnerability, rated CVSS 8.8, enables remote code execution via memory corruption, and both flaws are considered significant risks due to the availability of proof-of-concept exploit code and ongoing exploitation in the wild. CISA has mandated that Federal Civilian Executive Branch (FCEB) agencies apply the necessary patches by January 28, 2026, under Binding Operational Directive 22-01, and strongly encourages all organizations to update their systems immediately. There are no workarounds for the HPE OneView vulnerability, making prompt patching essential. The public release of exploit code for CVE-2025-37164 has heightened the urgency, and organizations are advised to follow vendor instructions or discontinue use of affected products if mitigations are unavailable. Both vulnerabilities are being actively targeted and pose significant risks to enterprise environments if left unaddressed.
Jun 29, 2026
Hewlett Packard Enterprise disclosed multiple high-severity vulnerabilities in **HPE EdgeConnect SD-WAN Orchestrator** that can let an unauthenticated remote attacker bypass web authentication by spoofing HTTP headers in the product's REST API. The issues, tracked as **`CVE-2026-63455`** and **`CVE-2026-63456`**, could expose system functions and allow viewing or modification of sensitive information, with potential impact to confidentiality, integrity, and availability. Both CVEs carry a **CVSS v3.1** rating of **`AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`**. Affected releases include **9.6.2.00000 through 9.6.2.40208** and **9.6.3.00000 through 9.6.3.40137**, which Canadian Centre for Cyber Security guidance summarized as **9.6.2.40208 and earlier** and **9.6.3.40137 and earlier**. HPE's bulletin **`HPESBNW05100 rev.1`** and related government advisories urge administrators to review the vendor guidance and apply updates as they become available to reduce exposure in internet-reachable orchestration environments.
Aug 5, 2026