CVE-2025-37092 is a Critical command injection remote code execution flaw in HPE StoreOnce Software, scored CVSS 9.8 with no login required. Read HPE bulletin hpesbst04847en_us for the fixed release, upgrade promptly and keep the appliance off untrusted networks. Check your version first.
What's affected
The record names HPE StoreOnce Software, and HPE's bulletin is hpesbst04847en_us. The record does not give version numbers, and the HPE page loads through scripts that I could not read automatically, so I cannot state affected or fixed versions here.
Open the bulletin and note the StoreOnce releases it lists, and the release it names as the fix. The same bulletin covers several CVEs, so one upgrade should cover all of them.
How to check if you're exposed
Note the StoreOnce Software version that your management interface reports, and compare it with the affected and fixed versions in the HPE bulletin. If you run more than one StoreOnce system, check each, including virtual appliances and any used only for lab or archive copies.
Also confirm which network segments can reach the management and data interfaces. Backup appliances are common ransomware targets, so exposure should be limited to backup and admin hosts.
What to do now
- Find every StoreOnce system and its software version.
- Open HPE bulletin hpesbst04847en_us and identify the fixed release.
- Schedule the upgrade, and test restores before and after the change.
- Restrict management and data interface access to the backup network and admin hosts.
- Review the appliance's accounts and logs for anything unexpected while you were on the old version.
Why it matters
The weakness is CWE-77 (Command Injection). Command injection happens when input reaches a command or interpreter without being kept apart from the instructions. The result is that the attacker's text is run as a command. HPE gives few details, so the record's one line description is the main source.
The vector is network, low complexity, no privileges and no interaction, with high impact. That combination is the reason to treat this one as urgent. It is one of several command injection flaws in the same HPE bulletin, so the upgrade that fixes one should fix the others. Check that the release you choose lists all of them. HPE published seven StoreOnce CVEs in one bulletin on the same day, which are CVE-2025-37089, CVE-2025-37090, CVE-2025-37091, CVE-2025-37092, CVE-2025-37094, CVE-2025-37095 and CVE-2025-37096.
Quick check
Which version fixes CVE-2025-37092?
The record gives no version. HPE bulletin hpesbst04847en_us lists the fix, so read it directly.
Is it exploited in the wild?
The record does not flag it as a CISA Known Exploited Vulnerability, and I found no claim of exploitation in the sources.
Sources
Last reviewed: 18 October 2026.
