Aruba VIA Client EUVD-2026-116200

Exploitation requires the HPE Aruba Virtual Intranet Access (VIA) client to be installed on the target host and the attacker to already hold low-privileged local access to that host (PR:L, AV:L); it cannot be triggered remotely or by an unauthenticated attacker. The specific mechanism of the missing integrity verification (which file, update, or component is not validated) is not described in the available sources, so the exact trigger artifact is unverified. No user interaction is needed (UI:N), and the vector implies default-configuration exploitability once local access and the client are present; the principal limiting factor is the need for a pre-existing local foothold.

This is a genuine priority rather than a CVSS-inflated non-issue, but its risk is bounded by the local attack vector. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, 8.4) describes a local, low-complexity attack requiring low privileges and no user interaction, with a changed scope and high confidentiality and integrity impact - consistent with a low-privileged local user escalating to elevated OS privileges via missing integrity verification in the Aruba Virtual Intranet Access (VIA) client. The elevated code execution is the main driver of the high score, not remote reach: an attacker must already have a foothold on the endpoint. vuln.today assigns a 'this_week' decision label, indicating meaningful but not emergency urgency. No CISA KEV listing and no EPSS score are present in the input, and no SSVC fields were supplied, so widespread or automated exploitation is not indicated by the available signals - the dominant concern is local privilege escalation on endpoints where the VIA client is installed. Missing data: no EPSS probability, no KEV status, no SSVC exploitation/automatable/technical-impact values, and no CWE were provided, so exploitation-likelihood signals are incomplete and the assessment leans on the CVSS vector plus the HPE advisory reference.

A low-privileged user (or malware running in a standard user context) on a Windows endpoint with the Aruba VIA client installed abuses the client's missing integrity verification to load or substitute an attacker-controlled component, which the privileged VIA process then executes. This yields arbitrary code execution with elevated privileges on the underlying operating system. No public exploit is identified in the provided data, and exploitation requires prior local access.