All vulnerabilities
CVE-2026-114462

Arbitrary File Read via Symlink in Velneo vServer HTTP Server

Velneo vServer
Open in ThreatlineRecord JSON
CVSS
6.0Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.30%Chance of exploitation activity in the next 30 days, higher than 22% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in36.6Also 37.2CVE List
Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Improper link resolution before file access ('link following') vulnerability in Velneo vServer. This issue affects vServer: from 32.3 before 36.6 and from 37.1 before 37.2.

Text from CVE List

Affected versions 4

  • vServeraffected: 36.0 before 36.6CVE List
  • vServeraffected: 37.0 before 37.2CVE List
  • vServerunaffected: 36.6CVE List
  • vServerunaffected: 37.2CVE List

References 1