Research · Dec 16, 2025 · ZeroDay Catalog
Critical Code Injection Vulnerability in HPE OneView
A serious code injection vulnerability has been identified in HPE OneView, enabling remote code execution by unauthenticated users.
What changed
Hewlett Packard Enterprise (HPE) has reported a significant code injection vulnerability in its OneView product. This flaw allows remote unauthenticated users to execute arbitrary code, posing a severe security risk.
The vulnerability highlights the need for immediate attention to system configurations and access controls.
Who is affected
Organizations utilizing HPE OneView are at risk due to this vulnerability. The potential for remote code execution can lead to unauthorized access and system compromise.
It is crucial for users to assess their exposure and implement necessary mitigations.
- Hewlett Packard Enterprise (HPE) OneView users
- Data centers relying on HPE infrastructure
- IT departments managing HPE solutions
- Organizations with remote access configurations
What to do
Immediate action is recommended for all affected users of HPE OneView. Regular updates and patches should be applied to mitigate this vulnerability.
Review access controls and ensure that only authorized personnel have access to sensitive systems.
- Apply the latest security patches from HPE.
- Conduct a security audit of current configurations.
- Limit remote access to OneView where possible.
- Monitor systems for any unusual activity.