---
id: "CVE-2026-95724"
kind: "vulnerability"
aliases: ["CVE-2026-95724"]
title: "HPE VIA: improper certificate validation lets remote attackers bypass authentication"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["aruba", "certificate-validation", "hpe", "infrastructure", "networking", "remote-access", "via", "vpn"]
not_affected_if: ["via-not-deployed"]
published_at: "2026-11-03T20:18:20+00:00"
first_seen_at: "2026-11-03T20:49:24+00:00"
updated_at: "2026-11-03T21:01:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95724", "first_seen_at": "2026-11-03T20:49:24+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T21:01:33+00:00"}]
---

# HPE VIA: improper certificate validation lets remote attackers bypass authentication

HPE Networking Virtual Intranet Access (VIA) does not properly validate certificates (CVSS 3.1 8.1, high). Per the HPE CNA description, an unauthenticated remote attacker could bypass authentication and possibly disclose sensitive information. The affected and fixed versions are unknown, and no exploitation is reported in the sources read.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check whether HPE Networking (Aruba) Virtual Intranet Access (VIA) is deployed, as a VPN client or with its controller/gateway, and note the installed version. Compare it with the version table in HPE bulletin HPESBNW05173 (support.hpe.com, docId hpesbnw05173en_us). Affected and fixed versions are unknown here because the bulletin body could not be read.

## Timeline

- 2026-11-03T20:49:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95724
- 2026-11-03T21:01:33+00:00 analyst — HPE bulletin HPESBNW05173 identified and linked (also covers other CVEs), but its body is JS-rendered and web-cli/browser-cli returned only the title, so affected/fixed versions are unread. CVSS 8.1 and the unauthenticated-remote description come from the HPE CNA text via cvefeed. The earlier advance notice HPESBNW05166 said HPE would not give versions in advance. Nothing verified. X not checked. To settle: open the bulletin in a browser for the version table.

## Documents

- [advisory] HPESBNW05173 rev.1 - Multiple Vulnerabilities in HPE Networking Virtual Intranet Access (VIA) https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US
- [mentions] CVE-2026-95724 - cvefeed (CVSS 8.1, HPE CNA text) https://cvefeed.io/vuln/detail/CVE-2026-95724

## From the sources

An improper certificate validation vulnerability exists in HPE Networking Virtual Intranet Access (VIA). Successful exploitation could allow an unauthenticated remote attacker to bypass authentication mechanisms, leading to the possible disclosure of sensitive information.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_