CVE-2025-37107 is a High severity (CVSS 7.3) authentication bypass flaw in HPE AutoPass License Server (APLS) before 9.18. It needs no credentials. HPE's bulletin hpesbgn04877en_us covers it. Upgrade to 9.18 or later and restrict which hosts can reach the server.
What's affected
The record says HPE AutoPass License Server (APLS) versions prior to 9.18 are affected, which implies 9.18 is the fixed release. HPE's bulletin is hpesbgn04877en_us. I could not read that page automatically, so confirm the fixed version and any workaround there. The same bulletin covers CVE-2025-37105, CVE-2025-37106 and CVE-2025-37107.
How to check if you're exposed
Open the AutoPass License Server admin interface and read the version. Anything below 9.18 is in scope. License servers are easy to forget because they run quietly in the background, so search your software asset records and network scans for APLS hosts as well.
Also check who can reach the server. Limit access to the clients and admins that need it.
What to do now
- Find every AutoPass License Server instance and its version.
- Upgrade to 9.18 or the release HPE names in bulletin hpesbgn04877en_us.
- Restrict network access to the license server to the hosts that need it.
- Review server accounts and logs for unexpected activity.
- Remove instances you no longer use.
Why it matters
The weakness is CWE-287 (Improper Authentication). A request can get past the login check, so functions meant for authenticated users can be reached by anyone with network access to the server.
The vector is network, low complexity, no privileges and no interaction, with low impact on confidentiality, integrity and availability. Low impact values reflect limited consequences on their own, but a license server that accepts unauthenticated requests is a poor place to rely on the login as your only control.
HPE fixed this together with CVE-2025-37105 and CVE-2025-37106. The record does not flag it as exploited. Put network controls in front of any such server so a login bug is not your last defence.
After upgrading, confirm the version shown in the admin interface is 9.18 or later and record it in your asset inventory. Check the server logs for requests from before the fix that you cannot explain, and keep a note of who owns the server so the next bulletin reaches the right person.
Quick check
Does a firewall help?
Yes. Limiting access to the hosts that need the license server reduces exposure while you plan the upgrade. It is not a substitute for patching.
Where do I find the fix?
The record says versions before 9.18 are affected. HPE bulletin hpesbgn04877en_us has the details.
Sources
Last reviewed: 18 October 2026.
