Hewlett Packard Enterprise (HPE) has released an urgent security warning about a critical flaw in its OneView management software. The vulnerability is rated at the highest severity level because of the serious risk it poses. HPE OneView is commonly used to manage servers and data-center infrastructure from a single platform. Due to its central role, any security issue in OneView can have a major impact on organizations.
The vulnerability is identified as CVE-2025-37164 and has been given a CVSS score of 10.0, which indicates maximum severity. HPE confirmed that the flaw can be exploited remotely over the network. An attacker does not need any authentication or valid login credentials. This makes the vulnerability especially dangerous in real-world environments.
According to HPE, the issue can be exploited by sending a specially crafted HTTP request to the OneView appliance. If the attack is successful, it allows remote code execution on the system. This means the attacker can run arbitrary commands on the affected appliance. Such access can lead to full system compromise.
HPE OneView is used to manage critical enterprise hardware such as servers, storage, and networking devices. Because it has high-level control over infrastructure, a compromised OneView system can become an entry point for further attacks. Security experts warn that attackers could move deeper into internal networks. This could result in data theft, service disruption, or ransomware deployment.
HPE has confirmed that all OneView versions earlier than 11.00 are affected by this vulnerability. Systems running these older versions remain exposed to the risk. To address the issue, HPE has released official updates and security patches. Customers are strongly advised to upgrade to OneView version 11.00 as soon as possible.
The company has clearly stated that there are no effective workarounds for this vulnerability. Limiting network access may reduce exposure but does not fully eliminate the risk. The only reliable solution is to apply the official patch or upgrade the software. HPE has warned against delaying the update under any circumstances.
Cybersecurity experts have highlighted that the flaw is easy to exploit due to its network-based nature. No user interaction is required for the attack to succeed. This increases the likelihood of exploitation by cybercriminals and ransomware groups. As a result, the vulnerability is considered highly attractive to threat actors.
Organizations using HPE OneView are advised to review their systems immediately. Administrators should check the installed version and apply the update without delay if required. After patching, systems should be monitored for any suspicious activity. Prompt action can significantly reduce the risk of serious security incidents.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
