{"id":"CVE-2026-95725","kind":"vulnerability","aliases":["CVE-2026-95725"],"related":[],"title":"HPE Networking VIA client for Linux: command injection lets local users run commands with elevated privileges (fixed in 4.7.9)","description":"A command injection vulnerability exists in the VIA client for Linux. Successful exploitation could allow a low-privileged local attacker to execute arbitrary commands with elevated privileges on the affected system.","summary":"The VIA client for Linux has a command injection flaw. A low-privileged local user can run arbitrary commands with elevated privileges on the affected system.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"VIA client","fixed":["4.7.9"],"affected":"<= 4.7.8","ecosystem":"vendor"}],"ecosystems":[],"tags":["hpe-aruba","linux","local-privilege-escalation","other","via-client","vpn-client"],"not_affected_if":["client-not-installed","version-4.7.9-or-later"],"how_to_check":"Check the installed VIA client version; 4.7.8 and below is affected per HPE advisory HPESBNW05173. The CVE entry is titled for the Linux client, while the advisory's affected-products list says all platforms, so check Linux first and also check Windows/macOS clients.","fix":"Upgrade the HPE Networking VIA client to 4.7.9 or later (download from networkingsupport.hpe.com).","status":"open","published_at":"2026-11-03T20:18:20+00:00","first_seen_at":"2026-11-03T20:49:24+00:00","triaged_at":"2026-11-03T20:50:00+00:00","updated_at":"2026-11-03T21:01:35+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-03T20:50:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"VIA client for Linux: command injection gives local users elevated privileges","impact":"high","summary":"The VIA client for Linux has a command injection flaw. A low-privileged local user can run arbitrary commands with elevated privileges on the affected system.","audience":"businesses","category":"other","nicknames":[],"who_cares":["linux","via-client"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local low-privileged user runs commands as root","analyst_note":"Check NVD and the vendor advisory for affected VIA client versions, the fixed version, and how the injection is triggered.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["client-not-installed"],"who_is_affected":"Systems where the VIA client for Linux is installed and local users who are not administrators can log in or run code. The sources do not name affected versions or the exact configuration, so the team should confirm whether the client is installed. Machines without the VIA client are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00061,"input_tokens":4073,"output_tokens":406,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check NVD and the vendor advisory for affected VIA client versions, the fixed version, and how the injection is triggered.","search":"'-2026':21A,24A '-95725':22A,25A '4.7.9':19A 'affect':68B,100C 'allow':84C 'arbitrari':61B,93C 'aruba':30B 'attack':90C 'client':4A,27A,39B,42B,45B,78C 'command':7A,13A,50B,62B,71C,94C 'could':83C 'cve':20A,23A 'elev':15A,64B,96C 'escal':35B 'execut':92C 'exist':74C 'exploit':82C 'fix':17A 'flaw':52B 'hpe':1A,29B 'hpe-aruba':28B 'inject':8A,51B,72C 'let':9A 'linux':6A,31B,47B,80C 'local':10A,33B,57B,89C 'local-privilege-escal':32B 'low':55B,87C 'low-privileg':54B,86C 'network':2A 'privileg':16A,34B,56B,65B,88C,97C 'run':12A,60B 'success':81C 'system':69B,101C 'user':11A,58B 'via':3A,26A,38B,44B,77C 'via-client':37B 'vpn':41B 'vpn-client':40B 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":"Machines running the HPE Networking VIA client version 4.7.8 or below. The CVE detail is specific to the Linux client; the advisory's affected list says all platforms. The attacker needs a local low-privilege account, so shared or multi-user Linux endpoints matter most. HPE says there is no workaround. Machines without the VIA client can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-03T21:01:35Z","by":"analyst","doc":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05173.txt","run_id":1556},"products":{"at":"2026-11-03T21:01:35Z","by":"analyst","doc":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05173.txt","run_id":1556},"workarounds":{"at":"2026-11-03T21:01:35Z","by":"analyst","doc":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05173.txt","run_id":1556},"how_to_check":{"at":"2026-11-03T21:01:35Z","by":"analyst","doc":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05173.txt","run_id":1556},"who_affected":{"at":"2026-11-03T21:01:35Z","by":"analyst","doc":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05173.txt","run_id":1556}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["client","viaclient"],"ptokens":["client","via"],"labels":["high","hpearuba","linux","localprivilegeescalation","other","viaclient","vpnclient"],"campaign_type":null,"first_public_at":"2026-11-03T20:18:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95725","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95725","severity":null,"published_at":"2026-11-03T20:18:20+00:00","modified_at":"2026-11-03T20:30:24+00:00","first_seen_at":"2026-11-03T20:49:24+00:00","fetched_at":"2026-11-03T20:49:24+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95725:1556","url":null,"severity":null,"published_at":"2026-11-03T21:01:35+00:00","modified_at":"2026-11-03T21:01:35+00:00","first_seen_at":"2026-11-03T21:01:35+00:00","fetched_at":"2026-11-03T21:01:35+00:00","note":"Read HPE advisory HPESBNW05173 (same one as sibling CVE-2026-95728): VIA client <=4.7.8 affected, fixed 4.7.9, no workaround, no known exploitation or public PoC. Reported by m0omo0d via bug bounty. CVSS 7.8. Per-CVE detail gives no trigger mechanics. Social not searched, low profile."}],"documents":[{"id":60672,"url":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05173.txt","title":"HPESBNW05173 rev.1 - Multiple Vulnerabilities in HPE Networking Virtual Intranet Access (VIA)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}