{"id":"CVE-2026-114405","kind":"vulnerability","aliases":["CVE-2026-114405"],"related":[],"title":"Velneo vServer: array index flaw in versions 36.0 to 36.6 and 37.0 to 37.2","description":"Improper validation of array index vulnerability in Velneo vServer. This issue affects vServer: from 36.0 before 36.6 and from 37.0 before 37.2.","summary":"Velneo vServer versions 36.0 before 36.6 and 37.0 before 37.2 do not validate an array index properly. The sources do not say what an attacker can do with it or whether it needs credentials.","severity":"high","cvss":8.7,"epss":0.00344,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","velneo","vserver"],"not_affected_if":["unknown"],"how_to_check":"Check the installed vServer version against 36.0 to 36.6 and 37.0 to 37.2 (unknown how to read it from the product).","fix":"Upgrade vServer to 36.6 or later for the 36 line, or 37.2 or later for the 37 line.","status":"open","published_at":"2026-10-21T13:18:32+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-23T22:36:54+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-23T22:36:54Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade vServer to 36.6 or later for the 36 line, or 37.2 or later for the 37 line.","reach":"unknown","title":"Velneo vServer: array index flaw in versions 36.0 to 36.6 and 37.0 to 37.2","impact":"medium","summary":"Velneo vServer versions 36.0 before 36.6 and 37.0 before 37.2 do not validate an array index properly. The sources do not say what an attacker can do with it or whether it needs credentials.","category":"other","who_cares":["velneo","vserver"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; the sources do not state the impact","analyst_note":"Find the vendor advisory or NVD detail for CVE-2026-114405 to confirm the attack vector, privileges required, and the exact fixed versions.","how_to_check":"Check the installed vServer version against 36.0 to 36.6 and 37.0 to 37.2 (unknown how to read it from the product).","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000491,"input_tokens":2850,"output_tokens":411,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114405':17A,20A '-2026':16A,19A '36.0':8A,27B,72C '36.6':10A,29B,74C '37.0':12A,31B,77C '37.2':14A,33B,79C 'affect':69C 'array':3A,38B,61C 'attack':48B 'credenti':57B 'cve':15A,18A 'flaw':5A 'improp':58C 'index':4A,39B,62C 'issu':68C 'need':56B 'proper':40B 'say':45B 'sourc':42B 'valid':36B,59C 'velneo':1A,22B,24B,65C 'version':7A,26B 'vserver':2A,23B,25B,66C,70C 'vulner':63C 'whether':54B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T13:18:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"6b608899-1da4-4a4d-8cfe-114101467ac1","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114405","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114405","severity":null,"published_at":"2026-10-21T13:18:32+00:00","modified_at":"2026-10-22T15:38:50+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114405","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114405","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}