On January 8, 2026, CISA expanded its Known Exploited Vulnerabilities (KEV) catalog. Specifically, they highlighted a dangerous trend where threat actors pair modern infrastructure flaws with decade-old legacy vulnerabilities. This exploitation of CVE-2025-37164 and CVE-2009-0556 underscores a critical reality: your security is only as resilient as your oldest “Technical Debt.”
1. HPE OneView Vulnerability Analysis (CVE-2025-37164)
First, let’s examine the modern threat. HPE OneView faces a critical risk, carrying a maximum CVSS score of 10 out of 10, which enables a complete infrastructure takeover.
- Mechanism: Improper input validation within the management fabric allows unauthenticated Remote Code Execution (RCE).
- Impact: Consequently, a successful exploit leads to a critical compromise of data center resources, including servers, storage, and networking.
2. Legacy PowerPoint Exploitation (CVE-2009-0556)
Despite its age, the 2009 PowerPoint bug remains a highly effective tool for bypassing modern perimeter defenses.
- In addition to modern flaws, the 2009 PowerPoint bug remains a highly effective tool. Surprisingly, attackers still use it to bypass modern perimeter defenses.
- Attack Vector: Attackers utilize precision spear-phishing with weaponized .ppt files.
- Strategic Risk: Therefore, this legacy flaw provides a foothold. It allows attackers to begin lateral movement toward high-value infrastructure.
3. Strategic Remediation for the January 28 Deadline
To address these threats, organizations must prioritize defense-in-depth measures before the January 28, 2026, deadline.
- Emergency Patching: Update all HPE OneView instances immediately to eliminate RCE entry points.
- Technical Debt Reduction: Decommission unsupported Microsoft Office versions (2003–2010). Furthermore, filter legacy binary formats at the email gateway.
- Network Segmentation: Isolate management fabrics to break the attack chain.
4. Key Takeaway for CISOs
In summary, once attackers gain a foothold via PowerPoint, they perform internal reconnaissance to find assets like HPE OneView. Thus, proactive patching is the most effective way to limit lateral movement risks.