Medium severity · published Oct 21, 2026
CVE-2026-114462
Arbitrary File Read via Symlink in Velneo vServer HTTP Server
New
6.0
CVSS
0.3%
EPSS
No
On KEV
Description
Improper link resolution before file access ('link following') vulnerability in Velneo vServer. This issue affects vServer: from 32.3 before 36.6 and from 37.1 before 37.2.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VS
vServer · Velneo
36.0 before 36.6; 37.0 before 37.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114462
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114462
velneo.es
https://velneo.es/avisos-de-seguridad/
More from vServer
8.7
CVE-2026-114405
Denial of Service via Malformed VATP Packet in Velneo vServer