Live › vulnerability › CVE-2026-95725
The VIA client for Linux has a command injection flaw. A low-privileged local user can run arbitrary commands with elevated privileges on the affected system.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 20:49 UTC. All times on this page are UTC.
Machines running the HPE Networking VIA client version 4.7.8 or below. The CVE detail is specific to the Linux client; the advisory's affected list says all platforms. The attacker needs a local low-privilege account, so shared or multi-user Linux endpoints matter most. HPE says there is no workaround. Machines without the VIA client can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| VIA client | vendor | <= 4.7.8 | 4.7.9 |
4.7.8 and below is affected per HPE advisory HPESBNW05173Upgrade the HPE Networking VIA client to 4.7.9 or later (download from networkingsupport.hpe.com).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A command injection vulnerability exists in the VIA client for Linux. Successful exploitation could allow a low-privileged local attacker to execute arbitrary commands with elevated privileges on the affected system.
This page as .md · .json · in your agent: get_signal("CVE-2026-95725")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.