CVE-2025-37089 is a Critical command injection remote code execution flaw in HPE StoreOnce Software, scored CVSS 9.8. It needs no login. HPE lists the fix in bulletin hpesbst04847en_us, so identify your version, upgrade to the release it names and limit network access to the appliance.
What's affected
The record names HPE StoreOnce Software, and HPE's bulletin is hpesbst04847en_us. The record does not give version numbers, and the HPE page loads through scripts that I could not read automatically, so I cannot state affected or fixed versions here.
Open the bulletin and note the StoreOnce releases it lists, and the release it names as the fix. The same bulletin covers several CVEs, so one upgrade should cover all of them.
How to check if you're exposed
Note the StoreOnce Software version that your management interface reports, and compare it with the affected and fixed versions in the HPE bulletin. If you run more than one StoreOnce system, check each, including virtual appliances and any used only for lab or archive copies.
Also confirm which network segments can reach the management and data interfaces. Backup appliances are common ransomware targets, so exposure should be limited to backup and admin hosts.
What to do now
- Find every StoreOnce system and its software version.
- Open HPE bulletin hpesbst04847en_us and identify the fixed release.
- Schedule the upgrade, and test restores before and after the change.
- Restrict management and data interface access to the backup network and admin hosts.
- Review the appliance's accounts and logs for anything unexpected while you were on the old version.
Why it matters
The weakness is CWE-77 (Command Injection). Command injection happens when input reaches a command or interpreter without being kept apart from the instructions. The result is that the attacker's text is run as a command. HPE gives few details, so the record's one line description is the main source.
The vector is network, low complexity, no privileges, no user interaction, with high impact everywhere, which gives 9.8. A backup appliance holds copies of your most sensitive data and often has credentials for the systems it protects, so full control of it is a serious event. HPE published seven StoreOnce CVEs in one bulletin on the same day, which are CVE-2025-37089, CVE-2025-37090, CVE-2025-37091, CVE-2025-37092, CVE-2025-37094, CVE-2025-37095 and CVE-2025-37096. Patch them together.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2025-37089?
The record gives no version. HPE bulletin hpesbst04847en_us lists the fix, so read it directly.
Is it exploited in the wild?
The record does not flag it as a CISA Known Exploited Vulnerability, and I found no claim of exploitation in the sources.
Sources
Last reviewed: 18 October 2026.
