---
id: "CVE-2026-95723"
kind: "vulnerability"
aliases: ["CVE-2026-95723"]
title: "HPE Networking VIA client: missing integrity verification allows local privilege escalation"
severity: "high"
cvss: 8.4
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["enterprise-vpn", "hpe-aruba", "local-privilege-escalation", "other", "via-client", "windows"]
not_affected_if: ["client-not-installed"]
published_at: "2026-11-03T20:18:20+00:00"
first_seen_at: "2026-11-03T20:49:24+00:00"
updated_at: "2026-11-03T21:02:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95723", "first_seen_at": "2026-11-03T20:49:24+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T21:02:52+00:00"}]
---

# HPE Networking VIA client: missing integrity verification allows local privilege escalation

HPE's advisory HPESBNW05173 covers a missing integrity verification flaw in the VIA client (CVSS 8.4, local, low privileges). A low-privileged local attacker could run code with elevated privileges. NVD does not say which platform is affected, so the Windows tag was dropped. The affected and fixed versions are not confirmed. HPE's generic guidance is to update the VIA client to the latest version. No exploitation or public PoC found.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check whether the HPE Aruba Networking Virtual Intranet Access (VIA) client is installed on any endpoint and note its version. Compare it with the fixed version in HPE advisory HPESBNW05173 (support.hpe.com, docId hpesbnw05173en_us). The page needs JavaScript, so open it in a browser. I could not read the version table.

## Timeline

- 2026-11-03T20:49:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95723
- 2026-11-03T21:02:52+00:00 analyst — Primary advisory HPESBNW05173 (HPE CNA) linked, but its body is JS-only and browser-cli session died, so versions, platform and fix are unread: nothing verified. Prior fix_status none is unsupported. NVD/cvefeed give only generic 'update to latest'. Revisit to read the advisory table.

## Documents

- [advisory] HPESBNW05173 rev.1 - Multiple Vulnerabilities in HPE Networking Virtual Intranet Access (VIA) https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US
- [mentions] CVE-2026-95723 (cvefeed, mirrors NVD/HPE CNA text) https://cvefeed.io/vuln/detail/CVE-2026-95723

## From the sources

A missing integrity verification vulnerability has been discovered in the Virtual Intranet Access (VIA) client. Successful exploitation of this vulnerability could allow a low-privileged local attacker to execute arbitrary code with elevated privileges on the underlying operating system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_