{"id":"CVE-2026-95724","aliases":[],"cve":{"records":[{"id":"CVE-2026-95724","source":"hpe","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-22T14:52:25.203Z","published":"2026-11-03T19:57:44.347Z","modified":"2026-11-06T19:46:50.480Z"}],"publishers":[{"name":"hpe","role":"CNA","organizationId":"eb103674-0d28-4225-80f8-39fb86215de0","modified":"2026-11-03T19:59:22.807Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-06T19:46:50.480Z"}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US","tags":[],"source":"hpe"}],"weaknesses":[{"id":"CWE-295","description":"CWE-295 Improper Certificate Validation","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-06T19:46:32.928856Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Unauthenticated Improper Certificate Validation leads to Authentication Bypass in HPE Networking Virtual Intranet Access (VIA)","titleSource":"hpe","descriptionSource":"hpe","description":"An improper certificate validation vulnerability exists in HPE Networking Virtual Intranet Access (VIA). Successful exploitation could allow an unauthenticated remote attacker to bypass authentication mechanisms, leading to the possible disclosure of sensitive information.","score":8.1,"severity":"high","published":"2026-11-03T19:57:44.347Z","modified":"2026-11-06T19:46:50.480Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Hewlett Packard Enterprise (HPE)","name":"Virtual Intranet Access (VIA)","platforms":[],"versions":[{"version":"0.0.0","status":"affected","lessThanOrEqual":"4.7.8","versionType":"semver"}],"defaultStatus":"affected","cpes":[],"source":"hpe","url":"https://www.cve.org/CVERecord?id=CVE-2026-95724"}],"remediation":[],"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US"],"sources":[{"name":"CVE","id":"CVE-2026-95724","modified":"2026-11-06T19:46:50.480Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-95724"}],"assessments":[{"source":"hpe","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","score":8.1}],"sourceAffected":[],"observedAt":"2026-11-06T20:05:59.407Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:30:32.029Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-06T20:15:32.531Z","attemptedAt":"2026-11-06T20:15:32.531Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-06T20:15:32.531Z","attemptedAt":"2026-11-06T20:15:32.531Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-06T20:15:32.531Z","attemptedAt":"2026-11-06T20:15:32.531Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-06T20:15:32.531Z","attemptedAt":"2026-11-06T20:15:32.531Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-95724","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95724","modified":"2026-11-03T20:30:24.880","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","checkedAt":"2026-11-06T20:15:32.531Z"},{"source":"ENISA EUVD","id":"EUVD-2026-116201","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-116201","modified":"Nov 3, 2026, 7:59:22 PM","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","checkedAt":"2026-11-06T20:15:32.531Z"},{"source":"GitHub Advisory Database","id":"GHSA-9934-3x3p-7hrm","url":"https://github.com/advisories/GHSA-9934-3x3p-7hrm","modified":"2026-11-03T21:32:21Z","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","checkedAt":"2026-11-06T20:15:32.531Z"},{"source":"FIRST EPSS","id":"CVE-2026-95724","url":"https://www.first.org/epss/","probability":0.00276,"percentile":0.20144,"date":"2026-11-06","checkedAt":"2026-11-06T20:15:32.531Z"}],"aiSummary":{"text":"HPE Networking Virtual Intranet Access (VIA) versions up to 4.7.8 have an improper certificate validation weakness, potentially allowing unauthenticated remote attackers to bypass authentication. This could lead to sensitive information disclosure.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-06T20:11:05.552Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-95724"}]}}