CISA Mandates Emergency Patches for Critical Microsoft Office and HPE OneView Flaws

The U.S. Cybersecurity and Infrastructure Security Agency has issued an urgent directive requiring federal agencies to address two actively exploited security weaknesses before the end of January. The announcement, made on Wednesday, places particular emphasis on a devastating flaw in Hewlett Packard Enterprise's infrastructure management platform that received the maximum possible severity rating.

Technical Breakdown of the Disclosed Flaws

The first vulnerability affects Microsoft Office PowerPoint through a code injection mechanism. Despite its age, this flaw has resurfaced in active exploitation campaigns, demonstrating how legacy vulnerabilities continue to pose risks when left unpatched.

The second and more severe issue targets HPE OneView—a widely deployed IT infrastructure management solution used by enterprises to oversee their entire technology stack from a single interface. This flaw enables completely unauthenticated attackers to execute malicious code remotely, making it particularly dangerous for organizations exposing these systems to network access.

Scope of Impact and Available Fixes

HPE disclosed the OneView vulnerability last month, confirming that every software iteration released before version 11.00 remains susceptible to exploitation. Organizations running older deployments can apply vendor-provided hotfixes covering versions 5.20 through 10.20.

Ongoing Uncertainty Around Attack Attribution

This ambiguity underscores the importance of proactive vulnerability management—organizations cannot afford to wait for attribution before taking protective action when active exploitation has been confirmed by federal authorities.