{"id":"CVE-2026-95727","kind":"vulnerability","aliases":["CVE-2026-95727"],"related":[],"title":"HPE Networking VIA: admin command injection grants elevated OS command execution","description":"A command injection vulnerability exists in HPE Networking VIA. Successful exploitation could allow an authenticated administrative user to execute arbitrary commands with elevated privileges on the underlying operating system.","summary":"HPE Networking VIA has a command injection flaw that lets an authenticated administrative user run arbitrary commands on the underlying operating system with elevated privileges. An attacker who already holds admin credentials can take control of the host beyond the management interface.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["admin-required","authenticated","hpe-networking-via","infrastructure","network-appliance","vpn"],"not_affected_if":["auth-required","no-admin-access-exposed","no-hpe-networking-via"],"how_to_check":"Unknown: affected VIA versions are not readable yet. Open HPESBNW05173 on support.hpe.com and compare your VIA version. Until then, review who holds VIA administrator accounts.","fix":null,"status":"open","published_at":"2026-11-03T20:18:20+00:00","first_seen_at":"2026-11-03T20:49:24+00:00","triaged_at":"2026-11-03T20:50:16+00:00","updated_at":"2026-11-03T21:01:40+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-03T20:50:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"HPE Networking VIA: admin command injection grants elevated OS command execution","impact":"high","summary":"HPE Networking VIA has a command injection flaw that lets an authenticated administrative user run arbitrary commands on the underlying operating system with elevated privileges. An attacker who already holds admin credentials can take control of the host beyond the management interface.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["hpe-networking-via","network-appliance"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Admin user runs arbitrary commands as elevated OS user","analyst_note":"Check the NVD entry and HPE security bulletin for affected VIA versions, fixed releases and any mitigation.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-hpe-networking-via","no-admin-access-exposed"],"who_is_affected":"The description says the flaw is reachable by an authenticated administrative user of HPE Networking VIA, so systems that run VIA and expose admin accounts are the ones to look at. Teams without VIA deployments can skip it. The sources do not list affected versions or configurations.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000647,"input_tokens":4075,"output_tokens":479,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and HPE security bulletin for affected VIA versions, fixed releases and any mitigation.","search":"'-2026':13A,16A '-95727':14A,17A 'admin':4A,19B,61B 'admin-requir':18B 'administr':43B,88C 'allow':85C 'alreadi':59B 'applianc':29B 'arbitrari':46B,92C 'attack':57B 'authent':21B,42B,87C 'beyond':69B 'command':5A,10A,36B,47B,74C,93C 'control':65B 'could':84C 'credenti':62B 'cve':12A,15A 'elev':8A,54B,95C 'execut':11A,91C 'exist':77C 'exploit':83C 'flaw':38B 'grant':7A 'hold':60B 'host':68B 'hpe':1A,23B,31B,79C 'hpe-networking-via':22B 'infrastructur':26B 'inject':6A,37B,75C 'interfac':72B 'let':40B 'manag':71B 'network':2A,24B,28B,32B,80C 'network-appli':27B 'oper':51B,100C 'os':9A 'privileg':55B,96C 'requir':20B 'run':45B 'success':82C 'system':52B,101C 'take':64B 'under':50B,99C 'user':44B,89C 'via':3A,25B,33B,81C 'vpn':30B 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"Teams running HPE Networking Virtual Intranet Access (VIA) where someone holds administrative credentials. The flaw lets an authenticated admin run commands on the underlying OS with elevated privileges, so it matters most if admin accounts are shared, weak or exposed. If admin access is tightly limited, the risk is lower, but patch when the fixed release is confirmed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["adminrequired","authenticated","high","hpenetworkingvia","infrastructure","networkappliance","vpn"],"campaign_type":null,"first_public_at":"2026-11-03T20:18:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95727","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95727","severity":null,"published_at":"2026-11-03T20:18:20+00:00","modified_at":"2026-11-03T20:30:24+00:00","first_seen_at":"2026-11-03T20:49:24+00:00","fetched_at":"2026-11-03T20:49:24+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95727:1554","url":null,"severity":null,"published_at":"2026-11-03T21:01:40+00:00","modified_at":"2026-11-03T21:01:40+00:00","first_seen_at":"2026-11-03T21:01:40+00:00","fetched_at":"2026-11-03T21:01:40+00:00","note":"HPE bulletin HPESBNW05173 rev.1 (linked) returned only its title via web-cli; no affected versions or fixed releases readable. CNA text (HPE, via cvefeed) CVSS 3.1 7.2: authenticated admin command injection to OS command execution with elevated privileges. No exploitation or PoC seen. Nothing verified. Settle by reading the bulletin body in a browser."}],"documents":[{"id":60674,"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US","title":"HPESBNW05173 rev.1 - Multiple Vulnerabilities in HPE Networking Virtual Intranet Access (VIA)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":60677,"url":"https://cvefeed.io/vuln/detail/CVE-2026-95727","title":"CVE-2026-95727 - cvefeed (CNA text from security-alert@hpe.com)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}