CISA flags exploited Office relic alongside fresh HPE flaw

CISA has added a pair of security holes to its actively exploited list, warning that attackers are now abusing a maximum-severity bug in HPE's OneView management software and a years-old flaw in Microsoft Office. The latest update to CISA's Known Exploited Vulnerabilities catalog flags CVE-2025-37164, a code injection vulnerability in HPE OneView, and CVE-2009-0556, a PowerPoint code injection bug that's been lurking for more than 15 years. CVE-2025-37164 carries a perfect 10.0 CVSS score and affects HPE OneView, software used to manage servers, storage, and networking gear from a central console. In a December 18 advisory, HPE said the flaw could be exploited to inject and execute code, potentially granting full control of affected environments, though it did not say at the time whether attacks were already underway. CISA's decision to add the flaw to its exploited-in-the-wild catalog suggests that has now changed, even if details remain thin. HPE did not respond to The Register's questions about whether attackers have been observed in customer environments, how many customers might be exposed, or if any data has been exfiltrated as a result of exploitation. Security firms, however, previously warned that the bug was unlikely to remain theoretical for long. Following HPE's disclosure, a proof-of-concept exploit was published by Rapid7, which suggested defenders treat the issue as an assumed-breach scenario. eSentire noted that the availability of working exploit code signifi...