Live › vulnerability › CVE-2026-95728
The Virtual Intranet Access (VIA) client has an arbitrary file write flaw. A local user with low privileges can write files anywhere they choose and use that to gain higher privileges on the machine.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 20:49 UTC. All times on this page are UTC.
Machines running the HPE Networking (Aruba) Virtual Intranet Access (VIA) VPN client version 4.7.8 or below. The attacker needs a local low-privilege account on the machine, so shared or multi-user endpoints matter most. HPE's detail heading names the Linux client; the affected-products list says all platforms. Machines without the VIA client can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| VIA client | vendor | <= 4.7.8 | 4.7.9 |
4.7.8 and below is affectedUpgrade the HPE Networking VIA client to 4.7.9 or later (download from networkingsupport.hpe.com).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An arbitrary file write vulnerability exists in the Virtual Intranet Access (VIA) client. Successful exploitation could allow a local attacker with low privileges to escalate privileges on the affected system.
This page as .md · .json · in your agent: get_signal("CVE-2026-95728")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.