{"id":"CVE-2026-95728","kind":"vulnerability","aliases":["CVE-2026-95728"],"related":[],"title":"HPE Networking VIA client for Linux: arbitrary file write lets local users escalate privileges (fixed in 4.7.9)","description":"An arbitrary file write vulnerability exists in the Virtual Intranet Access (VIA) client. Successful exploitation could allow a local attacker with low privileges to escalate privileges on the affected system.","summary":"The Virtual Intranet Access (VIA) client has an arbitrary file write flaw. A local user with low privileges can write files anywhere they choose and use that to gain higher privileges on the machine.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"VIA client","fixed":["4.7.9"],"affected":"<= 4.7.8","ecosystem":"vendor"}],"ecosystems":[],"tags":["endpoints","hpe-aruba","linux","local-privilege-escalation","other","via-client","vpn-client","windows"],"not_affected_if":["client-not-installed","version-4.7.9-or-later"],"how_to_check":"Check the installed VIA client version; 4.7.8 and below is affected. Advisory HPESBNW05173 lists the VIA client as affected on all platforms, but titles this CVE as Linux, so check Linux clients first and Windows/macOS clients too.","fix":"Upgrade the HPE Networking VIA client to 4.7.9 or later (download from networkingsupport.hpe.com).","status":"open","published_at":"2026-11-03T20:18:20+00:00","first_seen_at":"2026-11-03T20:49:24+00:00","triaged_at":"2026-11-03T20:50:20+00:00","updated_at":"2026-11-03T21:00:40+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-03T20:50:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Virtual Intranet Access client: arbitrary file write lets local users escalate privileges","impact":"high","summary":"The Virtual Intranet Access (VIA) client has an arbitrary file write flaw. A local user with low privileges can write files anywhere they choose and use that to gain higher privileges on the machine.","audience":"businesses","category":"other","nicknames":[],"who_cares":["via-client","windows","endpoints"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains higher privileges on the affected system","analyst_note":"Check the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-95728) and the vendor advisory for affected versions, the fixed version and any workaround.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["client-not-installed"],"who_is_affected":"Machines where the Virtual Intranet Access (VIA) client is installed. The sources do not name affected versions or say how the client is deployed, so unknown. Exposure requires a local low-privilege account on the machine.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000632,"input_tokens":4087,"output_tokens":447,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-95728) and the vendor advisory for affected versions, the fixed version and any workaround.","search":"'-2026':19A,22A '-95728':20A,23A '4.7.9':17A 'access':46B,87C 'affect':105C 'allow':93C 'anywher':64B 'arbitrari':7A,51B,78C 'aruba':29B 'attack':96C 'choos':66B 'client':4A,25A,38B,41B,48B,89C 'could':92C 'cve':18A,21A 'endpoint':26B 'escal':13A,34B,101C 'exist':82C 'exploit':91C 'file':8A,52B,63B,79C 'fix':15A 'flaw':54B 'gain':71B 'higher':72B 'hpe':1A,28B 'hpe-aruba':27B 'intranet':45B,86C 'let':10A 'linux':6A,30B 'local':11A,32B,56B,95C 'local-privilege-escal':31B 'low':59B,98C 'machin':76B 'network':2A 'privileg':14A,33B,60B,73B,99C,102C 'success':90C 'system':106C 'use':68B 'user':12A,57B 'via':3A,24A,37B,47B,88C 'via-client':36B 'virtual':44B,85C 'vpn':40B 'vpn-client':39B 'vulner':81C 'window':42B 'write':9A,53B,62B,80C","nicknames":[],"mitigations":[],"who_affected":"Machines running the HPE Networking (Aruba) Virtual Intranet Access (VIA) VPN client version 4.7.8 or below. The attacker needs a local low-privilege account on the machine, so shared or multi-user endpoints matter most. HPE's detail heading names the Linux client; the affected-products list says all platforms. Machines without the VIA client can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-03T21:00:40Z","by":"analyst","doc":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05173.txt","run_id":1553},"products":{"at":"2026-11-03T21:00:40Z","by":"analyst","doc":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05173.txt","run_id":1553},"workarounds":{"at":"2026-11-03T21:00:40Z","by":"analyst","doc":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05173.txt","run_id":1553},"how_to_check":{"at":"2026-11-03T21:00:40Z","by":"analyst","doc":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05173.txt","run_id":1553},"who_affected":{"at":"2026-11-03T21:00:40Z","by":"analyst","doc":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05173.txt","run_id":1553}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["client","viaclient"],"ptokens":["client","via"],"labels":["endpoints","high","hpearuba","linux","localprivilegeescalation","other","viaclient","vpnclient","windows"],"campaign_type":null,"first_public_at":"2026-11-03T20:18:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95728","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95728","severity":null,"published_at":"2026-11-03T20:18:20+00:00","modified_at":"2026-11-03T20:30:24+00:00","first_seen_at":"2026-11-03T20:49:24+00:00","fetched_at":"2026-11-03T20:49:24+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95728:1553","url":null,"severity":null,"published_at":"2026-11-03T21:00:40+00:00","modified_at":"2026-11-03T21:00:40+00:00","first_seen_at":"2026-11-03T21:00:40+00:00","fetched_at":"2026-11-03T21:00:40+00:00","note":"Read HPE advisory HPESBNW05173 (CSAF txt): VIA client <=4.7.8 affected, fixed 4.7.9, no workaround, no known exploitation/public PoC. Triage tagged windows; vendor heading says Linux, affected list says all platforms. Reported by Lucid_Duck via bug bounty. CVSS 7.1. Not searched social: low-profile. Workaround: none per vendor."}],"documents":[{"id":60672,"url":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05173.txt","title":"HPESBNW05173 rev.1 - Multiple Vulnerabilities in HPE Networking Virtual Intranet Access (VIA)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}