First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-37106

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An authentication bypass and disclosure of information vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Hewlett Packard Enterprise	HPE AutoPass License Server	< 9.18

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04877en_usVendor Advisory

Timeline

Published: Jul 16, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-371079.8An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18.CVE-2025-371083.5Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product CVE-2025-371093.5Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product CVE-2025-37119.8The LCD KVM over IP Switch CL5708IM has a Stack-based Buffer Overflow vulnerability in firmware versions prior to v2.2.215, allowing unauthe CVE-2025-371106.0A vulnerability was discovered in the storage policy for certain sets of sensitive credential information in the HPE Telco Network Function CVE-2025-371116.0A vulnerability was discovered in the storage policy for certain sets of authentication keys in the HPE Telco Network Function Virtual Orche CVE-2025-371126.0A vulnerability was discovered in the storage policy for certain sets of encryption keys in the HPE Telco Network Function Virtual Orchestra CVE-2025-37127.5The LCD KVM over IP Switch CL5708IM has a Heap-based Buffer Overflow vulnerability in firmware versions prior to v2.2.215, allowing unauthen CVE-2025-371226.1A vulnerability in the web-based management interface of network access control services could allow an unauthenticated remote attacker to c CVE-2025-371238.8A vulnerability in the command-line interface of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attack CVE-2025-371248.6A vulnerability in the HPE Aruba Networking SD-WAN Gateways could allow an unauthenticated remote attacker to bypass firewall protections. S CVE-2025-371257.5A broken access control vulnerability exists in HPE Aruba Networking EdgeConnect OS (ECOS). Successful exploitation could allow an attacker

CVE-2025-37106: Critical severity, CVSS 9.8 | Vulnix