Brief Summary: HPE Networking VIA CVE-2026-95724 Improper Certificate Validation Leading to Authentication Bypass

Introduction

The HPE Networking Virtual Intranet Access (VIA) client accepts certificates it should reject. The flaw could let an unauthenticated remote attacker bypass authentication and possibly obtain sensitive information. Remote employees use VIA to reach internal networks, so a weakness in how it verifies its peer undermines the trust the whole remote-access tunnel depends on.

VIA is HPE's remote-access VPN client. It runs on employee computers and mobile devices and builds VPN tunnels to a corporate VPN concentrator, carrying traffic to corporate resources over the Internet. HPE is an established enterprise networking vendor: in May 2026 it reported its 20th consecutive appearance in the Leaders Quadrant of Gartner's Magic Quadrant for Enterprise Wired and Wireless LAN Infrastructure. That ranking covers LAN infrastructure, not VIA security. VIA matters because it is an authenticated entry point into enterprise networks, deployed alongside VPN concentrators that can include virtual gateways in public cloud environments.

HPE, acting as the CVE Numbering Authority, rates CVE-2026-95724 as CVSS 3.1 8.1 High. The fix is VIA 4.7.9. Below we summarize what HPE has published, what it has not, and what that means for remediation.

Technical information

Root cause as published

HPE titles the issue "Unauthenticated Improper Certificate Validation leads to Authentication Bypass in HPE Networking Virtual Intranet Access (VIA)." The public description makes three points:

• the client performs improper certificate validation
• this can allow an unauthenticated remote attacker to bypass authentication mechanisms
• successful exploitation may lead to disclosure of sensitive information

HPE has not described the underlying implementation defect. VIA is closed source, so there is no public commit, diff or code snippet to examine. Neither the CVE record nor NVD assigns a CWE, and NVD currently marks the record as "Awaiting Enrichment."

Where certificates fit into VIA

HPE's VIA Remote Access Solution Guide describes several places where certificates can appear:

• Transport: IPsec, with SSL fallback
• Tunnel authentication: a preshared key or a digital certificate
• User authentication: credentials, tokens or digital certificates

These are product capabilities, not a published exploit path. HPE does not say which connection or authentication stage CVE-2026-95724 affects.

Reading the CVSS vector

HPE published the following vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

The individual metrics are:

• AV:N: exploitable over the network
• AC:L: low attack complexity
• PR:N: the attacker needs no privileges
• UI:R: a user other than the attacker must take some action
• S:U: scope is unchanged
• C:H / I:H: high confidentiality and integrity impact
• A:N: no availability impact

Unauthenticated does not mean no interaction. PR:N and UI:R together mean the attacker needs no account, but exploitation depends on a user doing something. The advisory does not specify what that action is.

The ratings also describe potential impact, not a demonstrated attack. FIRST defines the Base Score as intrinsic severity under a reasonable worst-case impact assumption. The high integrity rating should not be read as evidence of code execution or administrator takeover. The advisory text describes only authentication bypass and possible information disclosure.

Likely attack flow

HPE's patch notes say the UI:R component fits a scenario where a victim's VIA client connects to an endpoint the attacker controls or sits in front of, and the client accepts a certificate it should have rejected. Based on that framing and the CVSS vector, an attack would generally go like this:

1. Position. The attacker controls, or sits in front of, an endpoint the VIA client will talk to. No credentials are needed (PR:N).
2. Victim action. A user takes the action required by UI:R, which leads the VIA client to connect.
3. Certificate acceptance. The attacker's endpoint presents a certificate that a correct validator would reject. An affected client (4.7.8 or earlier) accepts it.
4. Authentication bypass. Trusting the wrong peer, the client continues with authentication or profile download, which can lead to authentication bypass and possible exposure of sensitive information.

This describes the bug class, not a confirmed sequence. HPE has not published the certificate property that is mishandled, a crafted certificate format, the required attacker positioning, a target endpoint or port, or reproduction steps.

Exploitation status

At release on 3 November 2026, HPE stated it was not aware of public discussion or exploit code targeting the vulnerabilities in the advisory. That statement applies to the release date only.

• HPE's internal security research found the flaw.
• No threat actors, campaigns or indicators of compromise have been identified.
• The CISA KEV catalog snapshot we reviewed (version 2026.10.30) predates this CVE, so it cannot confirm current KEV status either way.

Patch information

HPE fixed CVE-2026-95724 in HPE Networking Virtual Intranet Access (VIA) 4.7.9, shipped in security bulletin HPESBNW05173 rev.1 on 3 November 2026. The patch is available only as the new client build.

What the vendor record says

• Affected: VIA client on all platforms, versions 4.7.8 and below. The CSAF advisory encodes this as vers:semver/>=0.0.0|<=4.7.8, and NVD lists the same range.
• Fixed: the CSAF product_status.fixed field for this CVE lists 4.7.9. The remediation type is vendor_fix, and HPE recommends upgrading to 4.7.9 and above.
• Internal tracking ID: VULN-1411, from HPE's own internal security research.
• Where to get it: the HPE Networking Support Portal (networkingsupport.hpe.com). HPE does not publish a public, unauthenticated download link for the binary.
• Workaround: none. The advisory says the upgrade is the only permanent fix.

What the patch changes, conceptually

A fix for this class of bug normally makes the client run the full set of TLS/X.509 checks before it trusts the peer and continues with authentication or profile download:

• the certificate chains to a trusted root
• the certificate is within its validity period
• the hostname or identity matches the expected gateway or controller
• a validation failure stops the connection instead of being ignored or quietly overridden

HPE has not said which of these checks was missing or broken in 4.7.8 and earlier. Treat this list as a description of the bug class, not of the actual code change.

Same release, other fixes

VIA 4.7.9 is a combined security update. Alongside CVE-2026-95724, it fixes eight other VIA CVEs: CVE-2026-95722, CVE-2026-95723 and CVE-2026-95725 through CVE-2026-95730. These include local privilege escalation, command injection and buffer overflow issues. A single upgrade to 4.7.9 or later closes all nine. There is no standalone hotfix for this CVE.

For automated processing, HPE publishes a machine-readable CSAF 2.0 advisory and a signed text copy at csaf.arubanetworking.hpe.com/2026/ (the hpesbnw05173 JSON and TXT files). You can match fleet inventory against the fixed version without parsing the HTML bulletin.

Affected systems and versions

• Affected: HPE Networking VIA client, all platforms, versions 4.7.8 and below.
• Fixed: VIA 4.7.9 and later.
• Not affected: HPE says other HPE Networking products and versions not listed in the advisory are not affected. The gateways and concentrators described in VIA documentation are architectural context, not affected products for this CVE.
• Platform scope: the affected range applies to all platforms. Platform limits from earlier VIA bulletins, such as Windows-only issues, do not narrow this finding.
• Version boundary: 4.7.8 is itself affected. The remediation target is 4.7.9 or later, not 4.7.8, and not the older 4.7.2 fix from a previous bulletin.

Vendor security history

VIA has received earlier security fixes, but they involve different mechanisms and were fixed in different versions:

• CVE-2024-3661 (TunnelVision): a DHCP network configuration weakness that allows interception of traffic expected to be protected by the VPN. Bulletin HPESBNW04841, released 1 April 2025, listed VIA 4.7.0 and earlier, excluding Android, and supplied 4.7.2 or later for Linux, macOS, iOS and Windows.
• CVE-2025-25041: an arbitrary file overwrite with SYSTEM privileges and possible Windows denial of service. It affected the Windows client and was corrected in 4.7.2 or later.

These older fixes do not cover CVE-2026-95724. A client on 4.7.2 through 4.7.8 is still affected.

HPE handles vulnerabilities through its Product Security Response Team. Its published policy references ISO/IEC 29147:2018 and ISO/IEC 30111, generally ties public disclosure to the availability of permanent fixes, and offers a security bulletin library and email notification service. For this CVE, the flaw came from internal discovery, and HPE released a public advisory, a fixed build and a CSAF version on the same day.

References

• NVD: CVE-2026-95724
• CVE Record: CVE-2026-95724
• HPE Security Bulletin HPESBNW05173 rev.1: Multiple Vulnerabilities in HPE Networking Virtual Intranet Access (VIA)
• HPE CSAF 2.0 advisory for HPESBNW05173
• HPE Security Bulletin HPESBNW04841 rev.1: Multiple Vulnerabilities in HPE Aruba Networking VIA Client
• HPE VIA Remote Access Solution Guide
• HPE Aruba VIA documentation home
• HPE press release: 2026 Gartner Magic Quadrant for Enterprise Wired and Wireless LAN Infrastructure
• HPE Product Security Response Policy
• CISA Known Exploited Vulnerabilities Catalog
• CISA KEV machine readable feed
• FIRST CVSS v3.1 Specification Document