HPE VIA Client EUVD-2026-116199

Exploitation requires the attacker to already have local, authenticated access with low privileges (PR:L) on a host that has the Aruba/HPE Virtual Intranet Access (VIA) client installed; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The exploit is not remote (AV:L), which is the primary limiting factor - an attacker must first establish a foothold on the endpoint. The precise VIA feature, service, or component abused to gain elevated privileges is not described in the available sources, and affected/fixed version constraints are not provided in the input.

The signals point to a credible but contained local-privilege-escalation risk rather than an internet-facing emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C) describes an attacker who already has a low-privileged foothold on a host running the Aruba/HPE Virtual Intranet Access (VIA) client and can, with low complexity and no user interaction, cross a privilege boundary (scope change) to execute commands with elevated OS privileges - hence the high 8.8 severity and C:H/I:H/A:H impact. The vuln.today decision label is 'this_week', indicating meaningful but non-emergency urgency. There is no CISA KEV listing and no EPSS score supplied in the input, so there is no public evidence of active exploitation or a computed exploitation-probability; the absence of an EPSS value means exploitation likelihood cannot be quantified here rather than being confirmed low. No public exploit or PoC reference is present in the input. The signals are mutually consistent (local vector, prior access required, no exploitation evidence), so this reads as a genuine patch-this-cycle item for fleets running VIA - high impact if an attacker is already on the box, but gated behind that local foothold rather than a remotely weaponizable flaw.

An attacker who already holds a low-privileged account on a workstation running the HPE/Aruba VIA client (for example via phishing, a stolen credential, or an unprivileged service) abuses the client to run arbitrary commands with elevated privileges, obtaining full control of the operating system. No user interaction is required, and attack complexity is low once local access exists. No public exploit code is identified at time of analysis.