HPE patched a critical OneView vulnerability with CVSS 10.0 that could allow unauthenticated remote code execution in versions before 11.00.