---
id: "CVE-2026-114405"
kind: "vulnerability"
aliases: ["CVE-2026-114405"]
title: "Velneo vServer: array index flaw in versions 36.0 to 36.6 and 37.0 to 37.2"
severity: "high"
cvss: 8.7
epss: 0.00344
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "velneo", "vserver"]
not_affected_if: ["unknown"]
published_at: "2026-10-21T13:18:32+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-24T13:15:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114405", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114405", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Velneo vServer: array index flaw in versions 36.0 to 36.6 and 37.0 to 37.2

Velneo vServer versions 36.0 before 36.6 and 37.0 before 37.2 do not validate an array index properly. The sources do not say what an attacker can do with it or whether it needs credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check the installed vServer version against 36.0 to 36.6 and 37.0 to 37.2 (unknown how to read it from the product).

## Fix

Upgrade vServer to 36.6 or later for the 36 line, or 37.2 or later for the 37 line.

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114405
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114405

## From the sources

Improper validation of array index vulnerability in Velneo vServer. This issue affects vServer: from 36.0 before 36.6 and from 37.0 before 37.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_