---
id: "CVE-2026-95726"
kind: "vulnerability"
aliases: ["CVE-2026-95726"]
title: "HPE Networking VIA: buffer overflow lets unauthenticated attacker crash client"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "VIA client", "fixed": ["4.7.9"], "affected": "<= 4.7.8", "ecosystem": "vendor"}]
ecosystems: []
tags: ["denial-of-service", "hpe-networking-via", "infrastructure", "vpn-client"]
not_affected_if: ["not-installed", "version-4.7.9-or-later"]
published_at: "2026-11-03T20:18:20+00:00"
first_seen_at: "2026-11-03T20:49:24+00:00"
updated_at: "2026-11-03T21:01:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95726", "first_seen_at": "2026-11-03T20:49:24+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T21:01:45+00:00"}]
---

# HPE Networking VIA: buffer overflow lets unauthenticated attacker crash client

A buffer overflow in HPE Networking VIA lets a remote attacker with no login interrupt normal operation of the affected client. The sources describe a denial of service, not code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:VIA client affected <= 4.7.8 fixed 4.7.9

## How to check

Check the installed VIA client version on every platform; 4.7.8 and below is affected, 4.7.9 and above is fixed per HPESBNW05173. No workaround exists, so patching is the only remedy. HPE does not state which network path reaches the flaw, so treat any VIA client that connects to networks you do not control as exposed.

## Fix

Upgrade HPE Networking VIA to 4.7.9 or later (download from networkingsupport.hpe.com).

## Timeline

- 2026-11-03T20:49:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95726
- 2026-11-03T21:01:45+00:00 analyst — Read HPE advisory HPESBNW05173 (CSAF txt): VIA client all platforms <=4.7.8 affected, fixed 4.7.9, no workaround. HPE found it internally, no known public discussion or exploit code. Advisory does not name the attack path. X/social not searched; low-profile.

## Documents

- [advisory] HPESBNW05173 rev.1 - Multiple Vulnerabilities in HPE Networking Virtual Intranet Access (VIA) https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05173.txt

## From the sources

A buffer overflow vulnerability in HPE Networking VIA could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to interrupt the normal operation of the affected client.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_