CVE-2026-114405

HighCVSS 8.7

Published: 21/10/2026(UTC)Updated: 22/10/2026(UTC)Translated: 22/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

27th percentile - higher than 27% of all known CVEs

Summary

An improper array index validation vulnerability in Velneo vServer affects versions from 36.0 before 36.6 and from 37.0 before 37.2. The flaw may lead to unsafe out-of-bounds memory access.

Risk Assessment

An attacker may exploit the improper index validation to cause a crash or potentially execute code in the server context, threatening confidentiality and availability of the application.

Recommendation

Upgrade Velneo vServer to version 36.6 or 37.2 (or later) for the respective branch in use.

Other vulnerabilities in Velneo vServer

CVE-2026-114462Medium
Velneo vServer contains an improper link resolution before file access ('link following') vulnerability. This issue affects vServer from 32.3 before 36.6 and from 37.1 before 37.2.

Original NVD description (English source)

Improper validation of array index vulnerability in Velneo vServer. This issue affects vServer: from 36.0 before 36.6 and from 37.0 before 37.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS