Overview
CISA has added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after reports of active exploitation: an OS command injection in Collabora Online Built-in CODE Server and a SQL injection in Arista VeloCloud Orchestrator (VCO). Federal civilian agencies have until October 26, 2026 to apply fixes.
The Vulnerabilities
CVE-2026-110447 — Collabora Online (CVSS 9.2)
- Product: Collabora Online Built-in CODE Server (
richdocumentscode), commonly deployed with Nextcloud. - Flaw: OS command injection that can allow remote code execution through
proxy.phpwhen the CODE local document server is not running. - Fixed in: version 26.4.303, released in September 2026.
- Exploitation: Attackers have used the bug to plant web shells on Nextcloud servers, then run reconnaissance and search for credential stores, password manager artifacts and cryptocurrency wallets.
CVE-2026-114625 — Arista VeloCloud Orchestrator (CVSS 9.9)
- Product: On-premises Arista VeloCloud Orchestrator.
- Flaw: SQL injection that lets a remote attacker reach privileged internal functionality. Any authenticated user can gain operator privileges and masquerade as a local "superuser operator".
- Requirements: Access to the VCO web interface and a valid session. The lowest built-in tenant role, Enterprise Read Only, is sufficient.
- Fixed in: 5.2.3.18, 6.1.3.10 and 6.4.2.12. Hosted VCO deployments are already patched.
- Exploitation: Arista confirms in-the-wild abuse but has not attributed it to an actor or said how many organizations are affected. It published two Japan-geolocated IP addresses, 74.82.197[.]86 and 38.54.50[.]151.
Third VCO Zero-Day in Four Months
CVE-2026-114625 is the third VCO flaw exploited in the wild since July 2026, following CVE-2026-16812 and CVE-2026-93952, both rated CVSS 10.0. VCO is exposed by default and Arista says no configuration change prevents that exposure, so patching is the only complete remedy.
Recommended Actions
- Collabora/Nextcloud: update the Built-in CODE Server app to 26.4.303 or later and hunt for unexpected PHP files and web shells on Nextcloud hosts.
- Arista VCO: upgrade on-prem installations to a fixed release and restrict the web interface to trusted administrative networks.
- Block the published IP addresses and review VCO logs for unexpected role changes.
- If compromise is suspected, preserve web, application, system and database logs and file-system timestamps before remediation.
- Rotate credentials stored on or reachable from affected hosts.