The US cybersecurity company CISA on Wednesday warned {that a} critical-severity vulnerability within the OneView product from Hewlett Packard Enterprise (HPE) has been exploited in assaults.
Tracked as CVE-2025-37164 (CVSS rating of 10/10), the safety defect was disclosed on December 17, 2025, when HPE launched hotfixes for it.
HPE credited Nguyen Quoc Khanh for reporting the bug however shunned sharing technical info.
“This vulnerability might be exploited, permitting a distant unauthenticated person to carry out distant code execution,” HPE mentioned.
In keeping with cybersecurity agency Rapid7, the difficulty possible impacts a particular REST API endpoint reachable with out authentication.
On Wednesday, CISA added the flaw to its Recognized Exploited Vulnerabilities (KEV) catalog, warning that it has been exploited within the wild.Commercial. Scroll to proceed studying.
“Hewlett Packard Enterprise OneView accommodates a code injection vulnerability that permits a distant unauthenticated person to carry out distant code execution,” the cybersecurity company notes.
CISA has not shared particulars on the noticed assaults.
On Wednesday, the company additionally added to the KEV record a code injection defect in Microsoft Workplace that was disclosed in 2009.
Tracked as CVE-2009-0556, the bug was exploited in espionage campaigns in opposition to the Uyghur ethnic group in China over a decade in the past.
Per Binding Operational Directive (BOD) 22-01, federal businesses have three weeks to establish weak HPE OneView and Microsoft Workplace cases of their environments and patch them.
Whereas BOD 22-01 solely applies to federal businesses, all organizations are suggested to evaluate CISA’s KEV catalog and apply mitigations and patches for the vulnerabilities in it.
Associated: Hackers Exploit Zero-Day in Discontinued D-Hyperlink Gadgets
Associated: Contemporary MongoDB Vulnerability Exploited in Assaults
Associated: WatchGuard Patches Firebox Zero-Day Exploited within the Wild
Associated: Vulnerability in Totolink Vary Extender Permits Gadget Takeover
