{"id":"CVE-2026-95722","kind":"vulnerability","aliases":["CVE-2026-95722"],"related":[],"title":"Virtual Intranet Access client: local users can gain elevated system privileges","description":"A local privilege escalation vulnerability has been discovered in the Virtual Intranet Access (VIA) client. Successful exploitation of this vulnerability could allow a local attacker with low privileges to execute arbitrary commands with elevated privileges on the underlying operating system.","summary":"HPE Networking's Virtual Intranet Access (VIA) client has a local privilege escalation flaw (CVSS 8.8, rated by HPE). A low-privileged local user can run arbitrary commands with elevated privileges on the host OS. HPE's bulletin, probably HPESBNW05173, should list versions and fixes. I could not read it, so versions and fix are unknown.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aruba","endpoints","hpe","infrastructure","via-client","vpn","windows"],"not_affected_if":["client-not-installed"],"how_to_check":"Find out whether the HPE Aruba / HPE Networking VIA client is installed on endpoints and note its version (on Windows, Apps & features; on Linux, the package manager). Compare it with the affected and fixed versions in HPE bulletin HPESBNW05173 (support.hpe.com, docId hpesbnw05173en_us). Not yet confirmed that this CVE is in that bulletin.","fix":null,"status":"open","published_at":"2026-11-03T20:18:20+00:00","first_seen_at":"2026-11-03T20:49:24+00:00","triaged_at":"2026-11-03T20:49:44+00:00","updated_at":"2026-11-03T21:02:57+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-03T20:49:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Virtual Intranet Access client: local users can gain elevated system privileges","impact":"high","summary":"The Virtual Intranet Access (VIA) client has a local privilege escalation flaw. A local attacker with low privileges can run arbitrary commands with elevated privileges on the underlying operating system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["via-client","windows","endpoints"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local low-privilege user runs commands as administrator or root","analyst_note":"Find the affected VIA client versions and vendor advisory; the NVD entry gives no product ranges or fix.","how_to_check":"- Check whether the Virtual Intranet Access (VIA) client is installed on endpoints and note its installed version.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["client-not-installed"],"who_is_affected":"Machines where the Virtual Intranet Access (VIA) client is installed, particularly those shared by multiple local users. The sources do not name affected versions or the exact component involved. Systems without the VIA client are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000642,"input_tokens":4113,"output_tokens":462,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected VIA client versions and vendor advisory; the NVD entry gives no product ranges or fix.","search":"'-2026':13A,16A '-95722':14A,17A '8.8':42B 'access':3A,32B,96C 'allow':105C 'arbitrari':54B,114C 'aruba':18B 'attack':108C 'bulletin':65B 'client':4A,24B,34B,98C 'command':55B,115C 'could':74B,104C 'cve':12A,15A 'cvss':41B 'discov':91C 'elev':9A,57B,117C 'endpoint':19B 'escal':39B,87C 'execut':113C 'exploit':100C 'fix':72B,81B 'flaw':40B 'gain':8A 'host':61B 'hpe':20B,27B,45B,63B 'hpesbnw05173':67B 'infrastructur':21B 'intranet':2A,31B,95C 'list':69B 'local':5A,37B,50B,85C,107C 'low':48B,110C 'low-privileg':47B 'network':28B 'oper':122C 'os':62B 'privileg':11A,38B,49B,58B,86C,111C,118C 'probabl':66B 'rate':43B 'read':76B 'run':53B 'success':99C 'system':10A,123C 'under':121C 'unknown':83B 'user':6A,51B 'version':70B,79B 'via':23B,33B,97C 'via-client':22B 'virtual':1A,30B,94C 'vpn':25B 'vulner':88C,103C 'window':26B","nicknames":[],"mitigations":[],"who_affected":"Machines where the Virtual Intranet Access (VIA) client is installed, particularly those shared by multiple local users. The sources do not name affected versions or the exact component involved. Systems without the VIA client are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aruba","endpoints","high","hpe","infrastructure","viaclient","vpn","windows"],"campaign_type":null,"first_public_at":"2026-11-03T20:18:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95722","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95722","severity":null,"published_at":"2026-11-03T20:18:20+00:00","modified_at":"2026-11-03T20:30:24+00:00","first_seen_at":"2026-11-03T20:49:24+00:00","fetched_at":"2026-11-03T20:49:24+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95722:1559","url":null,"severity":null,"published_at":"2026-11-03T21:02:57+00:00","modified_at":"2026-11-03T21:02:57+00:00","first_seen_at":"2026-11-03T21:02:57+00:00","fetched_at":"2026-11-03T21:02:57+00:00","note":"Vendor is HPE (Aruba) Networking; CVE published 2026-11-03 with a batch of VIA CVEs (CVE-2026-95722..95730). Likely covered by HPE bulletin HPESBNW05173 (cited by sibling CVE-2026-95723), but that page is JS-only and the browser is out of quota, so I could not read versions, fix or platform. The 10-28 advance notice (HPESBNW05166) names VIA but gives no versions. Nothing verified; revisit when the bulletin text is readable. The Windows tag is unconfirmed: older VIA Windows-client CVEs exist but this one is not tied to a platform in anything I read."}],"documents":[{"id":60674,"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US","title":"HPESBNW05173 rev.1 - Multiple Vulnerabilities in HPE Networking Virtual Intranet Access (VIA)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":60682,"url":"https://vulners.com/hpe/HPESBNW05166","title":"HPESBNW05166 advance notification for November 03, 2026 (VIA, Fabric Composer; no versions given)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}