CVE-2025-37106 is a High severity (CVSS 7.3) authentication bypass and information disclosure flaw in HPE AutoPass License Server (APLS) before 9.18. It needs no login. HPE's bulletin hpesbgn04877en_us covers it, so upgrade to 9.18 or later and limit network access.
What's affected
The record says HPE AutoPass License Server (APLS) versions prior to 9.18 are affected, which implies 9.18 is the fixed release. HPE's bulletin is hpesbgn04877en_us. I could not read that page automatically, so confirm the fixed version and any workaround there. The same bulletin covers CVE-2025-37105, CVE-2025-37106 and CVE-2025-37107.
How to check if you're exposed
Open the AutoPass License Server admin interface and read the version. Anything below 9.18 is in scope. License servers are easy to forget because they run quietly in the background, so search your software asset records and network scans for APLS hosts as well.
Also check who can reach the server. Limit access to the clients and admins that need it.
What to do now
- Find every AutoPass License Server instance and its version.
- Upgrade to 9.18 or the release HPE names in bulletin hpesbgn04877en_us.
- Restrict network access to the license server to the hosts that need it.
- Review server accounts and logs for unexpected activity.
- Remove instances you no longer use.
Why it matters
The weakness is CWE-287 (Improper Authentication). The server can be reached without proper authentication, and data it should protect can be disclosed. HPE gives no further detail in the record.
The vector is network, low complexity, no privileges and no interaction, with low impact on each of confidentiality, integrity and availability. The impact scores are low, which is why the total is 7.3, but authentication bypass flaws are often chained with other bugs. The sibling CVE-2025-37107 is also an authentication bypass in the same product, and CVE-2025-37105 is a code execution flaw, so an attacker could in principle combine such weaknesses. That is my reasoning, not a statement from HPE.
The record does not flag exploitation.
After upgrading, check the server's logs for unexpected requests from before the fix, and confirm the version shown in the admin interface is 9.18 or later. If you manage many sites, record the version in your asset inventory so the next bulletin is quick to scope.
Quick check
Is this the same flaw as CVE-2025-37107?
No. Both are authentication bypass flaws in APLS, but this one also discloses information. They are separate CVEs fixed in the same bulletin.
What is the quickest mitigation?
Upgrade to 9.18 or later, and until then limit access to the license server to the hosts that need it.
Sources
Last reviewed: 18 October 2026.
