CVE-2025-37093: HPE Fixes Critical RCE Vulnerability in StoreOnce

On June 2, 2025, Hewlett Packard Enterprise (HPE) released fixes for multiple vulnerabilities affecting HPE StoreOnce VSA, an enterprise backup storage solution. The most severe of these was CVE-2025-37093, a critical authentication bypass vulnerability discovered by the Zero Day Initiative (ZDI). The flaw resides in the implementation of the machineAccountCheck method and stems from improper handling of an authentication algorithm. CVE-2025-37093 can potentially be chained with other, lower-severity vulnerabilities to achieve outcomes such as remote code execution, information disclosure, and directory traversal. 

Arctic Wolf has not observed any active exploitation of this vulnerability in the wild or any publicly available proof-of-concept (PoC) exploit. However, threat actors may target it in the near future, as backup solutions have been frequent targets in the past—evidenced by several vulnerabilities listed in CISA’s Known Exploited Vulnerabilities Catalog. 

Recommendation for CVE-2025-37093

Upgrade to Latest Fixed Version

Arctic Wolf strongly recommends that customers upgrade to the latest fixed version. 

Please follow your organization’s patching and testing guidelines to minimize potential operational impact. 

References 

• HPE Advisory

• ZDI CVE-2025-37093 Advisory

Resources

Understand the threat landscape, and how to better defend your organization, with the 2025 Arctic Wolf Threat Report

See how Arctic Wolf utilizes threat intelligence to harden your attack surface and stop threats earlier and faster