High severity · published Oct 21, 2026
CVE-2026-114405
Denial of Service via Malformed VATP Packet in Velneo vServer
8.7
CVSS
0.3%
EPSS
No
On KEV
Description
Improper validation of array index vulnerability in Velneo vServer. This issue affects vServer: from 36.0 before 36.6 and from 37.0 before 37.2.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VS
vServer · Velneo
36.0 before 36.6; 37.0 before 37.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114405
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114405
velneo.es
https://velneo.es/avisos-de-seguridad/
More from vServer
6.0
CVE-2026-114462
Arbitrary File Read via Symlink in Velneo vServer HTTP Server