CVE-2025-37164 Hewlett Packard Enterprise (HPE) OneView Code Injection
Attackers can execute arbitrary code remotely on HPE OneView infrastructure management servers.
- Exploited in the wild
- Since 7 Jan 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-37164?
CVE-2025-37164 is a critical code injection vulnerability in Hewlett Packard Enterprise (HPE) HPE OneView, published on 16 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A remote code execution issue exists in HPE OneView.
Weakness: CWE-94
Which versions are affected by CVE-2025-37164?
It affects 1 product.
Products include Hpe Oneview.
How do I fix CVE-2025-37164?
No fix has been published for CVE-2025-37164 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 28 Jan 2026.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-37164 being exploited?
Yes. Attackers have exploited CVE-2025-37164 in the wild since at least 7 Jan 2026.
Public exploit code: 1 Metasploit module, 1 Nuclei template and 3 proofs of concept on GitHub.
Other vulnerabilities in Hewlett Packard Enterprise (HPE) HPE OneView
Sources
Also known as GHSA-6pr3-cx3j-4949.