CVE-2025-37087

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability in the cmdb service of the HPE Performance Cluster Manager (HPCM) could allow an attacker to gain access to an arbitrary file on the server host.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Apr 22, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-370886.8A security vulnerability has been identified in HPE Cray Data Virtualization Service (DVS). Depending on race conditions and configuration, CVE-2025-370899.8A command injection remote code execution vulnerability exists in HPE StoreOnce Software.CVE-2025-37099.8Agentflow from Flowring Technology has an Account Lockout Bypass vulnerability, allowing unauthenticated remote attackers to exploit this vuCVE-2025-370909.8A server-side request forgery vulnerability exists in HPE StoreOnce Software.CVE-2025-370919.8A command injection remote code execution vulnerability exists in HPE StoreOnce Software.CVE-2025-370929.8A command injection remote code execution vulnerability exists in HPE StoreOnce Software.CVE-2025-370939.8An authentication bypass vulnerability exists in HPE StoreOnce Software.CVE-2025-370949.1A directory traversal arbitrary file deletion vulnerability exists in HPE StoreOnce Software.CVE-2025-370959.8A directory traversal information disclosure vulnerability exists in HPE StoreOnce Software.CVE-2025-370969.8A command injection remote code execution vulnerability exists in HPE StoreOnce Software.CVE-2025-370977.5A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of serviceCVE-2025-370987.5A path traversal vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646.
CVE-2025-37087: Critical severity, CVSS 9.8 | Vulnix