By Dark Reading
Publication Date: 2026-01-08 22:21:00
A maximum severity vulnerability in OneView, HPE’s software-defined management platform, has been attacked, according to the Cybersecurity and Infrastructure Security Agency (CISA).
CVE-2025-37164, which received a 10 cvss score, was added to CISA’s catalog of known exploited vulnerabilities (KEV) on Wednesday. He remote code execution (RCE) was first revealed by HPE on December 17 and a hotfix was released for all versions of IT infrastructure management software from 5.20 to 10.20.
At the time of disclosure, experts warned that CVE-2025-37164 required immediate action because OneView operates in a privileged control plane within customer networks. A view provides administrator-level control over servers, storage systems, network devices, firmware, and other assets within an enterprise environment.
“The reason this vulnerability has been assigned a maximum severity is because of what the software actually does,” Douglas McKee, director of vulnerability intelligence…
