HPE Aruba VIA EUVD-2026-116205

Exploitation requires the attacker to already have a local, low-privileged account or code execution on a system where the HPE Aruba Virtual Intranet Access (VIA) client is installed (AV:L, PR:L). The specific VIA file-write mechanism, the exact writable path, and whether a particular client configuration or platform (Windows/macOS) is required are NOT described in the available sources. Limiting factors: no remote exploitation is possible, a pre-existing local foothold is mandatory, and the VIA client must be present on the host; no user interaction is required (UI:N), so once local access exists there is no additional user-driven barrier.

This is a locally-exploitable privilege escalation (arbitrary file write) in the HPE Aruba Virtual Intranet Access (VIA) client, rated CVSS 7.1 (High) by the vendor with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. The attack vector is unambiguously LOCAL (AV:L) with low attack complexity (AC:L) and requires the attacker to already hold low-level privileges on the host (PR:L); no user interaction is needed (UI:N). This is therefore a post-access escalation primitive, not a remote entry point - an attacker must first have a foothold (a standard user account or low-privileged code execution) before this becomes useful. No EPSS score was supplied, so statistical exploitation probability cannot be quantified here. The CVE is NOT listed in CISA KEV and no proof-of-concept or exploit reference appears in the input, so there is no public exploit identified at time of analysis. The vuln.today priority is 'this_week', which places it above routine patching but below act_now/emergency; this is consistent with a high-severity local flaw lacking confirmed in-the-wild exploitation. Net assessment: a real but second-stage risk - meaningful on multi-user systems or where an attacker already has limited code execution, but not a drive-by remote threat. No conflicting signals in the CVSS vector versus the local-access description were found; they agree.

An attacker who already has a low-privileged foothold on a workstation running the Aruba VIA client abuses the client's file-handling to write a file to a location they should not control, using that write to overwrite or plant a privileged binary/configuration. The next privileged execution of that path runs attacker-controlled content, elevating the attacker to a higher privilege level (e.g., SYSTEM/root). Given AV:L/AC:L this is reliable once local access is obtained, though no public exploit code is identified at time of analysis.