H-ISAC TLP White Threat Bulletin: Active Exploitation of Critical HPE OneView RCE Flaw (CVE-2025-37164)

A maximum-severity vulnerability in HPE OneView, tracked as CVE-2025-37164, is being actively exploited in the wild.

This unauthenticated remote code execution (RCE) flaw carries a CVSS score of 10.0, allowing attackers to gain full control of data center infrastructure management systems. Organizations are urged to prioritize the immediate application of available security updates or hotfixes to mitigate the risk of compromise.

Health-ISAC provides this information to increase situational awareness and encourage organizations to assess their level of risk to this vulnerability.

View the detailed report below.