The Cybersecurity and Infrastructure Security Agency (CISA) has warned a critical vulnerability in software from Hewlett Packard Enterprise (HPE) is being actively exploited.

A bug in the software-defined infrastructure management platform HPE OneView allows for remote code execution by threat actors. Discovered in late December, the flaw (CVE-2025-37164) affects all iterations of HPE OneView up to version 11.00.

HPE promptly released patches for versions 5.20 through 10.20, with the security hotfix needing to be reapplied after an appliance upgrade from HPE OneView version 6.60.xx to 7.00.00, including any HPE Synergy Composer reinstallations.

In its advisory, CISA advised users to apply the patches and follow applicable BOD 22-01 guidance, a baseline for how federal bodies should manage high-risk vulnerabilities.

The OneView exploit follows RCE flaws seen last year in Cisco firewalls and its network access control (NAC) platform.

Microsoft was also not immune, with SharePoint servers under threat last summer from not one but two RCE vulnerabilities.

In a recent interview with SDxCentral, HPE Networking security chief David Hughes pressed on the importance of keeping software continuously updated, as well as pushing the security theme of zero trust.

“It's really important that customers are keeping all of their devices, whether that's a personal device, an IoT device, or a networking device, up to date. The idea of like, I'm going to wait a few months and see what happens, is not a good idea anymore, if it ever was."

“The great thing about a zero-trust type environment is when something is breached, when a device is breached with us, when you go out from that device to try and move laterally, you can't see anything, because the points you're not allowed to access are not there. So that zero trust principle of the minimum level of privilege really helps make networks far more robust from a security point of view."