Aruba VIA Client CVE-2026-95725

The attacker must already have local, low-privileged access (an existing unprivileged account or shell) on a Linux system on which the HPE Aruba Networking VIA client is installed; the flaw is then used to inject commands into a VIA client operation that runs with elevated privileges, achieving privilege escalation. Exploitation is LIMITED by the local-only attack vector (AV:L - no remote or network path), the requirement that the VIA Linux client actually be installed, and the need for a pre-existing foothold; no user interaction is required (UI:N). The exact feature, configuration, or input that is the injectable sink is not described in the available sources.

This is a locally-exploitable privilege escalation flaw, not a remotely-reachable one. The supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) is internally consistent with the description: a low-privileged local attacker (PR:L) with no user interaction (UI:N) gains full confidentiality, integrity and availability impact - i.e. command execution with elevated privileges. No EPSS probability, CISA KEV listing, or PoC/exploit reference is present in the input, so there is no public evidence of active exploitation or available exploit code; exploitation status is therefore 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_week,' which is a prioritize-but-not-emergency signal that aligns with a high-severity local flaw lacking exploitation evidence. The main limiting factor is the local attack vector: an attacker must already have a foothold (a low-privileged account) on a Linux host that has the VIA client installed, which meaningfully narrows real-world exposure compared to a network-facing bug of the same base score. Net assessment: a genuine high-severity local EoP worth patching on the stated weekly cadence, but not an emergency given AV:L and the absence of EPSS/KEV/PoC signals.

A local attacker who already has a low-privileged shell on a Linux endpoint running the HPE Aruba VIA client injects attacker-controlled input into a command the client executes with elevated privileges, causing arbitrary commands to run at the higher privilege level. The specific injection point and triggering input are not described in the available sources. No public exploit or PoC reference is provided.