CVE-2025-37091 is a High severity (CVSS 7.2) command injection remote code execution flaw in HPE StoreOnce Software. The vector needs high privileges, so an attacker needs an administrator level login first. HPE's bulletin hpesbst04847en_us names the fix, so upgrade. Check your version first.
What's affected
The record names HPE StoreOnce Software, and HPE's bulletin is hpesbst04847en_us. The record does not give version numbers, and the HPE page loads through scripts that I could not read automatically, so I cannot state affected or fixed versions here.
Open the bulletin and note the StoreOnce releases it lists, and the release it names as the fix. The same bulletin covers several CVEs, so one upgrade should cover all of them.
How to check if you're exposed
Note the StoreOnce Software version that your management interface reports, and compare it with the affected and fixed versions in the HPE bulletin. If you run more than one StoreOnce system, check each, including virtual appliances and any used only for lab or archive copies.
Also confirm which network segments can reach the management and data interfaces. Backup appliances are common ransomware targets, so exposure should be limited to backup and admin hosts.
What to do now
- Find every StoreOnce system and its software version.
- Open HPE bulletin hpesbst04847en_us and identify the fixed release.
- Schedule the upgrade, and test restores before and after the change.
- Restrict management and data interface access to the backup network and admin hosts.
- Review the appliance's accounts and logs for anything unexpected while you were on the old version.
Why it matters
The weakness is CWE-77 (Command Injection). Command injection happens when input reaches a command or interpreter without being kept apart from the instructions. The result is that the attacker's text is run as a command. HPE gives few details, so the record's one line description is the main source.
The CVSS vector requires high privileges, which is why this one scores 7.2 while its siblings score 9.8. Do not read that as low risk. Admin credentials for backup systems are a common target, and a flaw like this turns a stolen admin login into code execution on the appliance itself. HPE published seven StoreOnce CVEs in one bulletin on the same day, which are CVE-2025-37089, CVE-2025-37090, CVE-2025-37091, CVE-2025-37092, CVE-2025-37094, CVE-2025-37095 and CVE-2025-37096.
Quick check
Which version fixes CVE-2025-37091?
The record gives no version. HPE bulletin hpesbst04847en_us lists the fix, so read it directly.
Why is it High when similar flaws are Critical?
Its vector requires high privileges. The sibling command injection flaws need none, so they score 9.8.
Sources
Last reviewed: 18 October 2026.
