Hewlett Packard Enterprise (HPE) has released a security bulletin addressing eight (8) vulnerabilities in its StoreOnce backup and deduplication solution, urging users to upgrade to version 4.3.11. Among the issues is a critical authentication bypass flaw, tracked as CVE-2025-37093 (CVSS 9.8/10), which can undermine all other vulnerabilities by allowing attackers to gain unauthorized access. The update also resolves three (3) remote code execution flaws, two (2) directory traversal issues, a server-side request forgery (SSRF) vulnerability, and a sensitive information disclosure bug. All versions prior to 4.3.11 are affected, and HPE has not provided mitigations or workarounds, making immediate patching essential. Discovered by the Zero Day Initiative (ZDI), the flaws were reported in October 2024 but took seven (7) months to patch. While no active exploitation has been reported, the risk is significant due to StoreOnce’s widespread use in large enterprises, cloud environments, and data centers, particularly where it integrates with major backup tools like Veeam and Commvault. CTIX analysts recommend that all administrators ensure that their devices have been sufficiently updated to prevent exploitation.