---
id: "CVE-2026-95727"
kind: "vulnerability"
aliases: ["CVE-2026-95727"]
title: "HPE Networking VIA: admin command injection grants elevated OS command execution"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["admin-required", "authenticated", "hpe-networking-via", "infrastructure", "network-appliance", "vpn"]
not_affected_if: ["auth-required", "no-admin-access-exposed", "no-hpe-networking-via"]
published_at: "2026-11-03T20:18:20+00:00"
first_seen_at: "2026-11-03T20:49:24+00:00"
updated_at: "2026-11-03T21:01:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95727", "first_seen_at": "2026-11-03T20:49:24+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T21:01:40+00:00"}]
---

# HPE Networking VIA: admin command injection grants elevated OS command execution

HPE Networking VIA has a command injection flaw that lets an authenticated administrative user run arbitrary commands on the underlying operating system with elevated privileges. An attacker who already holds admin credentials can take control of the host beyond the management interface.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Unknown: affected VIA versions are not readable yet. Open HPESBNW05173 on support.hpe.com and compare your VIA version. Until then, review who holds VIA administrator accounts.

## Timeline

- 2026-11-03T20:49:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95727
- 2026-11-03T21:01:40+00:00 analyst — HPE bulletin HPESBNW05173 rev.1 (linked) returned only its title via web-cli; no affected versions or fixed releases readable. CNA text (HPE, via cvefeed) CVSS 3.1 7.2: authenticated admin command injection to OS command execution with elevated privileges. No exploitation or PoC seen. Nothing verified. Settle by reading the bulletin body in a browser.

## Documents

- [advisory] HPESBNW05173 rev.1 - Multiple Vulnerabilities in HPE Networking Virtual Intranet Access (VIA) https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US
- [describes] CVE-2026-95727 - cvefeed (CNA text from security-alert@hpe.com) https://cvefeed.io/vuln/detail/CVE-2026-95727

## From the sources

A command injection vulnerability exists in HPE Networking VIA. Successful exploitation could allow an authenticated administrative user to execute arbitrary commands with elevated privileges on the underlying operating system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_