Command Injection Vulnerability in VIA Client for Linux by HPE
CVE-2026-95725

7.8HIGH

Key Information:

Vendor

HP (HP)

Status
Virtual Intranet Access (via)
Vendor
CVE Published:
3 November 2026

What is CVE-2026-95725?

A command injection vulnerability exists in HPE's VIA client for Linux that allows low-privileged local attackers to execute arbitrary commands with elevated privileges. This poses a significant risk to the security and integrity of the affected systems as it enables unauthorized access and manipulation of system functions. Organizations must address this vulnerability promptly to mitigate potential exploitation.

Affected Version(s)

Virtual Intranet Access (VIA) 0.0.0 <= 4.7.8

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpe...

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

m0omo0d
.