The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a maximum-severity vulnerability in HPE OneView to its Known Exploited Vulnerabilities (KEV) catalog after identifying evidence of active exploitation. The flaw, tracked as CVE-2025-37164, affects all HPE OneView versions prior to 11.00 and allows unauthenticated attackers to achieve remote code execution (RCE) through low-complexity code-injection attacks, posing a serious risk to organizations that rely on the platform to centrally manage servers, storage, and networking infrastructure. HPE released patches and hotfixes in mid-December following responsible disclosure by a security researcher and has emphasized that upgrading to version 11.00 or later is the only effective remediation, as no workarounds or mitigations are available. Although the full scope of exploitation remains unclear, risk has increased due to the public release of a proof-of-concept exploit in late December. Under Binding Operational Directive 22-01, U.S. Federal Civilian Executive Branch (FCEB) agencies must remediate the vulnerability by no later than January 28, while CISA strongly urges private-sector organizations to patch immediately, warning that flaws of this nature are frequently leveraged by malicious actors and represent a significant threat to enterprise environments. CTIX analysts urge any impacted readers to follow the CISA guidance, and patch immediately.