# CVE-2025-37164

A remote code execution issue exists in HPE OneView.

- Page: https://www.vulneraibility.com/cve/CVE-2025-37164
- CVSS: 10.0
- Known exploited: yes, in CISA KEV since 2026-01-07; CISA due date 2026-01-28
- EPSS: 90.19%
- Public exploit code: 1 Metasploit module · 3 GitHub proofs of concept · 1 Nuclei template (first 2025-12-18)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2026-01-08)
- Weakness: CWE-94
- Published: 2025-12-16

## Affected versions

- Hewlett Packard Enterprise (HPE) HPE OneView: affected < 11.00

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US
- [advisory] https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US#vulnerability-summary-1
- [exploit] https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/hpe_oneview_rce.rb
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-37164

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.