CVE-2025-37164: HPE OneView remote code execution via code injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 unauthenticated network RCE, active exploitation per CISA KEV, and a public Metasploit exploit make this an urgent patch.

What it is

HPE OneView contains a code injection flaw (CWE-94) that allows remote code execution. The vulnerability is network-reachable with no privileges or user interaction required, and it is listed in CISA KEV, so it is being exploited in the wild.

Impact

An unauthenticated remote attacker can execute arbitrary code on the affected OneView appliance, gaining full control of the system and its managed infrastructure.

Attack surface

Reachable over the network via the OneView HTTP interface, per the CVSS vector AV:N/PR:N/UI:N. No authentication or user interaction is needed.

Exploitation

CISA added it to KEV on 2026-01-07 with a 2026-01-28 remediation due date, and a public Metasploit module exists. EPSS 30-day probability is 0.90193 (99.8th percentile), indicating active exploitation is expected.

What to do

• Apply the HPE vendor patch or documented mitigations from advisory hpesbgn04985en_us immediately.
• If no patch is available, isolate OneView management interfaces from untrusted networks per CISA BOD 22-01 guidance or discontinue use.
• Restrict network access to the OneView appliance to trusted management segments only.
• Monitor for and block exploitation attempts matching the public Metasploit module behavior.
• Verify remediation against the CISA KEV due date of 2026-01-28.

Detection

• Review OneView appliance logs for unexpected process execution or command injection patterns.
• Alert on HTTP requests to OneView endpoints matching known exploit signatures from the Metasploit module.
• Monitor for anomalous outbound connections or new processes spawned by the OneView service.
• Audit network access logs for unauthorized hosts reaching the OneView management interface.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.