CVE-2025-37090 is a Critical server-side request forgery flaw in HPE StoreOnce Software, scored CVSS 9.8 with no login needed. HPE's bulletin hpesbst04847en_us names the fixed release. Identify your version, upgrade, and limit which networks can reach the appliance. Check your version first.
What's affected
The record names HPE StoreOnce Software, and HPE's bulletin is hpesbst04847en_us. The record does not give version numbers, and the HPE page loads through scripts that I could not read automatically, so I cannot state affected or fixed versions here.
Open the bulletin and note the StoreOnce releases it lists, and the release it names as the fix. The same bulletin covers several CVEs, so one upgrade should cover all of them.
How to check if you're exposed
Note the StoreOnce Software version that your management interface reports, and compare it with the affected and fixed versions in the HPE bulletin. If you run more than one StoreOnce system, check each, including virtual appliances and any used only for lab or archive copies.
Also confirm which network segments can reach the management and data interfaces. Backup appliances are common ransomware targets, so exposure should be limited to backup and admin hosts.
What to do now
- Find every StoreOnce system and its software version.
- Open HPE bulletin hpesbst04847en_us and identify the fixed release.
- Schedule the upgrade, and test restores before and after the change.
- Restrict management and data interface access to the backup network and admin hosts.
- Review the appliance's accounts and logs for anything unexpected while you were on the old version.
Why it matters
The weakness is CWE-918 (Server-Side Request Forgery). In SSRF the server is tricked into making a request that the attacker chooses. That request comes from the appliance, so it can reach internal addresses and services that the attacker cannot reach directly.
The record's vector is network, low complexity, no privileges, no interaction and high impact, which is unusual for SSRF and suggests the request can be turned into more than a simple probe. HPE does not describe it in detail, so read the bulletin for specifics. On a backup appliance, internal reach is valuable because the appliance sits close to many other systems. HPE published seven StoreOnce CVEs in one bulletin on the same day, which are CVE-2025-37089, CVE-2025-37090, CVE-2025-37091, CVE-2025-37092, CVE-2025-37094, CVE-2025-37095 and CVE-2025-37096.
Quick check
Which version fixes CVE-2025-37090?
The record gives no version. HPE bulletin hpesbst04847en_us lists the fix, so read it directly.
Is it exploited in the wild?
The record does not flag it as a CISA Known Exploited Vulnerability, and I found no claim of exploitation in the sources.
Sources
Last reviewed: 18 October 2026.
