CISA adds exploited Collabora Online and VeloCloud flaws to KEV
Original title: CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
FCEB agencies must patch command injection in Collabora CODE Server and SQL injection in on-prem VeloCloud Orchestrator by October 26.
CISA added CVE-2026-110447 and CVE-2026-114625 to the Known Exploited Vulnerabilities catalog after reports of active exploitation. The Collabora Online Built-in CODE Server flaw can allow remote code execution through proxy.php when the local document server is not running, and attackers have used it to backdoor Nextcloud servers with a web shell. Arista’s on-premises VeloCloud Orchestrator SQL injection requires network access and a valid portal session with at least Enterprise Read Only rights. Federal Civilian Executive Branch agencies are advised to apply fixes by October 26, 2026.
Unconfirmed: Arista has not attributed the VeloCloud activity or disclosed how many organizations were affected.
- CVE-2026-110447 has CVSS 9.2 and was fixed in September 2026 in version 26.4.303.
- CVE-2026-114625 has CVSS 9.9 and is fixed in 5.2.3.18, 6.1.3.10, and 6.4.2.12.
- Arista tied activity to 74.82.197.86 and 38.54.50.151, both geolocated to Japan.
- Arista has not named an actor or described post-exploitation actions.
- Two earlier VeloCloud flaws were also exploited in the wild since July 2026.
Impact: Remote code execution or access to privileged VCO functions
| Product | Affected | Fixed in |
|---|---|---|
| Collabora Online Built-in CODE Server | — | 26.4.303 |
| Arista VeloCloud Orchestrator | on-premise versions | 5.2.3.18, 6.1.3.10, and 6.4.2.12 |
- 1.Update Collabora Online Built-in CODE Server to version 26.4.303.
- 2.Upgrade on-premises VeloCloud Orchestrator to 5.2.3.18, 6.1.3.10, or 6.4.2.12.
- 3.FCEB agencies should apply the fixes by October 26, 2026.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1059 Command and Scripting InterpreterT1505.003 Web Shell
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-110447 | Unauthenticated OS command injection in Nextcloud CODE Server | 9.2 | 12% | KEVPoC | KEV |
| CVE-2026-114625 | SQL injection in Arista VeloCloud Orchestrator grants superuser | 9.4 | 1% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 38.54.50.151 | an as responsible for driving the activity - 74.82.197[.]86 38.54.50[.]151 CVE-2026-114625 is the third vulnerability in the same pr |
| ipv4 | 74.82.197.86 | olocated to Japan as responsible for driving the activity - 74.82.197[.]86 38.54.50[.]151 CVE-2026-114625 is the third vulnerability |
From the original article
2 min read at thehackernews.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the wild.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.