CVE-2026-114405

waiting for further signals

GHSA-f334-8hf4-fmpm ↗EUVD-2026-107231 ↗

no check availablenot proven exploitable

cve.orgpublic pockev

Velneo vServer >= 36.0, < 36.6; >= 37.0, < 37.2

fixed in 36.6, 37.2

ETK-2026-2332, permanent identifier

cvss8.7cna vendorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

1h 28msince last run

12mAI analysis

timeline

0 = cve.org publication

trigger signal (cve.org) +0hwaiting for further signals+3h58m

+2h

+6h

+8h

+10h

+12h

description

Velneo vServer versions 36.0 through 36.5 and 37.0 through 37.1 are affected. A remote attacker able to reach a vulnerable service may trigger a denial of service through malformed network input; no authentication or user interaction is indicated.

mitigation

Upgrade the 36.x release line to 36.6 or later, or the 37.x release line to 37.2 or later. Restrict network access to vServer instances until updates are installed.

fixed in 36.6, 37.2

check

exploit

automation

contextual

auth required

EPSS

–

agent run time

12m

cve.org record, t = 0

2026-10-21 12:27Z

Δ to public poc

–

Δ to kev

–

outcome

Contextual: an exploit technique exists, but no deterministic check could cover this one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-21 12:27Z
ghsa: trigger signal, started the run
https://github.com/advisories/GHSA-f334-8hf4-fmpm
2026-10-21 12:27Z
cve.org record for CVE-2026-114405
cve_org · https://www.cve.org/CVERecord?id=CVE-2026-114405

this entry in the feed

GET /api/v1/feed/CVE-2026-114405

{
  "etk_id": "ETK-2026-2332",
  "cve_id": "CVE-2026-114405",
  "display_id": "CVE-2026-114405",
  "ghsa_id": "GHSA-f334-8hf4-fmpm",
  "euvd_id": "EUVD-2026-107231",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Array bounds validation flaw in Velneo vServer",
  "summary": "Velneo vServer versions 36.0 through 36.5 and 37.0 through 37.1 are affected. A remote attacker able to reach a vulnerable service may trigger a denial of service through malformed network input; no authentication or user interaction is indicated.",
  "mitigation": "Upgrade the 36.x release line to 36.6 or later, or the 37.x release line to 37.2 or later. Restrict network access to vServer instances until updates are installed.",
  "vendor": "Velneo",
  "product": "vServer",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 36.0, < 36.6",
        ">= 37.0, < 37.2"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "36.6",
        "37.2"
      ],
      "package_name": "vServer",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 12.338342783333333,
  "t0_at": "2026-10-21T12:27:00.706000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-21T12:27:00.706000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-21T12:27:00.706000+00:00",
      "url": "https://github.com/advisories/GHSA-f334-8hf4-fmpm"
    }
  }
}

published 2026-10-21 16:12Z
last change 2026-10-21 17:47Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.