CVE-2025-37105 is a High severity (CVSS 7.5) remote code execution flaw related to hsqldb in HPE AutoPass License Server (APLS) before 9.18. The vector is adjacent network. HPE's bulletin hpesbgn04877en_us covers it, so upgrade to 9.18 or later without delay.
What's affected
The record says HPE AutoPass License Server (APLS) versions prior to 9.18 are affected, which implies 9.18 is the fixed release. HPE's bulletin is hpesbgn04877en_us. I could not read that page automatically, so confirm the fixed version and any workaround there. The same bulletin covers CVE-2025-37105, CVE-2025-37106 and CVE-2025-37107.
How to check if you're exposed
Open the AutoPass License Server admin interface and read the version. Anything below 9.18 is in scope. License servers are easy to forget because they run quietly in the background, so search your software asset records and network scans for APLS hosts as well.
Also check who can reach the server. Limit access to the clients and admins that need it.
What to do now
- Find every AutoPass License Server instance and its version.
- Upgrade to 9.18 or the release HPE names in bulletin hpesbgn04877en_us.
- Restrict network access to the license server to the hosts that need it.
- Review server accounts and logs for unexpected activity.
- Remove instances you no longer use.
Why it matters
The weakness is CWE-94 (Code Injection). HPE describes an hsqldb related remote code execution flaw. HSQLDB is a Java database engine that can run in embedded form, and the record does not give more detail, so read the bulletin to understand the exact path.
The CVSS vector is adjacent network, high complexity, no privileges and no interaction, with high impact. Adjacent means the attacker needs to be on the same network segment, which lowers exposure for well segmented sites. High complexity also pulls the score to 7.5.
The record does not flag exploitation. Still, a license server often runs with wide permissions and sits in a management network, so an attacker who lands on that segment can use it to move further.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Can it be exploited from the internet?
The vector is adjacent network, so an attacker needs access to the same network segment. Do not expose the server to the internet in any case.
Which version fixes it?
The record says versions before 9.18 are affected. Confirm in HPE bulletin hpesbgn04877en_us.
Sources
Last reviewed: 18 October 2026.
