Critical HPE bug exploited: Backdoor, or bad security testing?

Just an undocumented utility API exposed on a public management port without an active session requirement giving an attacker access to all your servers then?

By Edward Targett

Updated Jan 9, 2026 11:31 AM / Published Jan 8, 2026 10:51 AM 3 min read

Critical HPE bug exploited: Backdoor, or bad security testing? — Image credit: https://unsplash.com/@vladimir_d

A critical pre-auth RCE bug in HPE’s IT infrastructure management software OneView – allocated CVE-2025-37164 – is now being exploited in the wild.

The vulnerability stems from the fact that HPE left an undocumented utility API exposed on a public management port without an active session requirement. Exploitation gives a successful attacker “god mode” powers.

Is this CVSS 10 bug a backdoor or a balls-up? Read on…

This content is for paying members only

Already have an account? Sign in

Add The Stack on Google

Edward Targett

Ed is a co-founder of The Stack. He previously edited Computer Business Review. He has also covered energy markets. He started his journalism career on local papers. He left school at 15 and has made a living asking "but why?" ever since.