CISA Flags Microsoft Office and HPE OneView Bugs as Actively Exploited

Microsoft Office PowerPoint is affected by a code injection vulnerability (CWE-94) in which a PowerPoint file containing an OutlineTextRefAtom record with an invalid index value corrupts memory when the file is processed. An attacker triggers the flaw by persuading a user to open or preview a crafted PowerPoint document, most plausibly delivered through email attachments or downloaded files. Successful exploitation yields remote code execution in the context of the user who opened the file. CISA lists the affected product simply as 'Microsoft Office' without version bounds; this is a 2009-era PowerPoint flaw, so realistic exposure centers on environments still running unpatched, legacy Office/PowerPoint components. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2026-01-07, confirming active exploitation in the wild (ransomware use unknown), and EPSS assigns a 67.5% probability of exploitation within 30 days (99th percentile), while no public proof-of-concept is known.

Do: Apply mitigations per Microsoft's instructions and applicable BOD 22-01 guidance for cloud services, or discontinue legacy PowerPoint use if mitigations are unavailable. Confirm that all endpoints carry the Office/PowerPoint security updates from 2009 that fixed this flaw, and audit the environment for old Office versions still in use (including on shared or kiosk machines) since in-the-wild exploitation has resumed. As an interim measure, avoid opening unsolicited or untrusted PowerPoint files until patches or mitigations are confirmed in place.

HPE OneView, HPE's infrastructure management platform, contains a code-injection flaw (CWE-94) that permits unauthenticated remote code execution, with a network-vector, low-complexity CVSS 3.1 score of 9.8 meaning no credentials, privileges, or user interaction are required. An attacker triggers the flaw by sending crafted code-injection input to the OneView appliance over the network, gaining code execution with high impact on the confidentiality, integrity, and availability of the appliance. A compromised OneView instance can serve as a foothold into the HPE server estate it manages, and the RondoDox botnet has already been observed folding this flaw into its exploitation waves. Any organization running an HPE OneView appliance is affected, particularly where the appliance is reachable from the internet. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-01-07, a public Metasploit exploit module is available, and EPSS assigns a 90.2% probability of exploitation within 30 days (100th percentile).

Do: Upgrade OneView to the fixed release specified in the HPE security bulletin for CVE-2025-37164 (exact version numbers are not included in this data), and treat patching as urgent given confirmed in-the-wild exploitation and the public Metasploit module. Until patched, remove unnecessary internet exposure of the OneView appliance and review appliance and network logs for signs of compromise, including possible RondoDox botnet infection. US federal agencies must apply mitigations per vendor instructions and BOD 22-01 guidance, or discontinue use of the product if mitigations are unavailable.