CVE-2026-114405

Received Received - Intake

Improper Array Index Validation in Velneo vServer

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: Velneo

Description

Improper validation of array index vulnerability in Velneo vServer. This issue affects vServer: from 36.0 before 36.6 and from 37.0 before 37.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114405

EUVD

EUVD-2026-107231

Affected Vendors & Products

Vendor	Product	Version / Range
Velneo	vServer	36.0
Velneo	vServer	37.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-129	The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

Executive Summary

CVE-2026-114405 is an improper array index validation vulnerability in Velneo vServer. It allows attackers to cause a Denial of Service (DoS) by sending a malformed VATP packet. The issue arises because the software fails to properly validate array indices, leading to potential crashes or service disruption.

Detection Guidance

The vulnerability can be detected by monitoring for crashes or denial of service events in Velneo vServer versions 36.0 to 36.5 and 37.0 to 37.1. Check server logs for malformed VATP packets causing array index errors. Ensure your vServer version is updated to 36.6 or 37.2 or later.

Impact Analysis

This vulnerability can impact you by causing your Velneo vServer to crash or become unresponsive. Attackers could exploit it to disrupt services, leading to downtime and potential loss of data or productivity. Systems running affected versions are at risk until patched.

Compliance Impact

The vulnerability allows for Denial of Service (DoS) attacks due to improper array index validation, which could lead to service disruption. This may impact compliance with regulations requiring data availability and integrity, such as GDPR (availability principle) and HIPAA (accessibility and integrity of PHI). However, specific compliance impacts are not detailed in the provided context.

Mitigation Strategies

Immediately update Velneo vServer to version 36.6 or 37.2 or later to patch the vulnerability. If immediate update is not possible, restrict network access to the vServer and monitor for suspicious activity until patched.

Hi! I’m here to help you understand CVE-2026-114405. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...