CVE-2025-37164

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A remote code execution issue exists in HPE OneView.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

VendorProductVersions
Hewlett Packard Enterprise (HPE)HPE OneView< 11.00

References

Timeline

Published
Dec 16, 2025
Last modified
Jun 17, 2026
Added to CISA KEV
Jan 7, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-371657.5A vulnerability in the router mode configuration of HPE Instant On Access Points exposed certain network configuration details to unintendedCVE-2025-371667.5A vulnerability affecting HPE Networking Instant On Access Points has been identified where a device processing a specially crafted packet cCVE-2025-371689.1Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system. SucceCVE-2025-371697.2A stack overflow vulnerability exists in the AOS-10 web-based management interface of a Mobility Gateway. Successful exploitation could alloCVE-2025-37172.1When using the Grafana Snowflake Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the sameCVE-2025-371707.2Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating sCVE-2025-371717.2Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating sCVE-2025-371727.2Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating sCVE-2025-371737.2An improper input handling vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 CVE-2025-371747.2Authenticated arbitrary file write vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 oCVE-2025-371757.2Arbitrary file upload vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operaCVE-2025-371767.2A command injection vulnerability in AOS-8 allows an authenticated privileged user to alter a package header to inject shell commands, poten