CVE-2025-37164 - PatchNow

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2025-12-16

Added to CISA KEV: 2026-01-07 22 DAYS BETWEEN CVE AND KEV

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity
Apply HPE-supplied hotfix immediately for all HPE OneView instances below version 11.00
Implement network segmentation to limit HPE OneView exposure to internet if not required
Monitor HPE OneView access logs for suspicious activities and unauthorized login attempts
Consider temporarily isolating HPE OneView systems until patching is complete
MAXIMUM PRIORITY patching due to active exploitation and perfect exploitability

Here's what is known about the CVE-2025-37164 vulnerability:

General Information:

CVE-2025-37164 is a remote code execution (RCE) vulnerability that exists in HPE OneView ^[1].
All versions below 11.00 are vulnerable if the vendor-supplied hotfix has not been applied ^[1].

Exploitation Details:

The vulnerability can be exploited to achieve unauthenticated RCE against Hewlett Packard Enterprise (HPE) OneView ^[1].

CISA Status:

CISA has added CVE-2025-37164 to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation ^[3]^[4].
CISA maintains the KEV catalog as an authoritative source of vulnerabilities exploited in the wild ^[2].
Organizations should use the KEV catalog to inform their vulnerability management prioritization framework ^[2].

Affected Applications/Services:

Attack Vectors/Exploitation Methods:

Internet-Facing Applications:

While not explicitly stated, the nature of a remote code execution vulnerability in HPE OneView suggests it could potentially affect internet-facing applications or services if the OneView instance is exposed.

Targeted Attacks:

The provided information does not specifically confirm if CVE-2025-37164 has been used in targeted attacks.

Technical Details/Internet Exploitability:

The vulnerability allows unauthenticated RCE, indicating it may be exploitable over a network without requiring prior authentication ^[1].

CVE-2025-37164 : A remote code execution issue exists in HPE OneView.
CVE-2025-37164 : A remote code execution issue exists in HPE OneView.This module exploits an unauthenticated RCE vulnerability, CVE-2025-37164, against Hewlett Packard Enterprise (HPE) OneView. All versions below 11.00 are vulnerable (so long as the vendor supplied hotfix has not been applied), howe…
Known Exploited Vulnerabilities Catalog
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catal…
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
CISA Adds One Vulnerability to the KEV Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.

🔴 CVE-2025-37164