Talk to an expert
PricingNewsTalk to an expert
Back to Newsroom
Threat Intel

CISA Flags Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud

A command injection bug in Collabora's built-in CODE server for Nextcloud and a SQL injection flaw in Arista VeloCloud Orchestrator are both under active attack and now on CISA's KEV list. Here's what's affected and what to do.

4T4Tify Team4Tify
Oct 25, 2026·5 min read
CISA Flags Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud

CISA Adds Exploited Collabora Online and Arista VeloCloud Flaws to KEV

Two critical vulnerabilities, one in the document server many Nextcloud deployments rely on and one in Arista's VeloCloud Orchestrator, are now officially listed as exploited in the wild. CISA has added both to its Known Exploited Vulnerabilities (KEV) catalog. If either product runs in your environment, treat patching as an emergency.

What happened

CVE-2026-110447 (CVSS 9.2): Collabora Online Built-in CODE Server. This is an operating system command injection flaw in the built-in CODE server (the richdocumentscode app) used inside Nextcloud. When the local CODE document server isn't running, an attacker can reach proxy.php and execute commands remotely. Attackers are already using it to plant web shells on Nextcloud servers. From there they run reconnaissance and go looking for credential stores, password-manager artifacts and cryptocurrency wallets. A fix shipped in September 2026 in version 26.4.303.

CVE-2026-114625 (CVSS 9.9): Arista VeloCloud Orchestrator (on-premises). This SQL injection flaw lets a remote attacker reach privileged internal functionality. Exploiting it requires network access to the VCO web interface and a valid authenticated session, but the lowest role, Enterprise Read Only, is enough. Arista has confirmed the bug is being actively exploited. It has not attributed the activity to any group, explained how attackers are using it or what they did after escalating privileges, or said how many organisations are affected. It has shared two IP addresses, geolocated to Japan, linked to the activity:

  • 74.82.197[.]86
  • 38.54.50[.]151

Fixed builds were released in October 2026: 5.2.3.18, 6.1.3.10 and 6.4.2.12.

This is the third VeloCloud Orchestrator vulnerability exploited in the wild since July 2026. The previous two were CVE-2026-16812 and CVE-2026-93952, both rated CVSS 10.0.

US Federal Civilian Executive Branch agencies have until 26 October 2026 to apply the fixes.

Why it matters

  • A collaboration server is a high-value foothold. A compromised Nextcloud instance exposes the files a business shares internally. The attackers here are specifically hunting for passwords and wallets, which points to credential theft and follow-on access, not simple defacement.
  • "Read-only" doesn't mean low-risk. The VCO flaw needs a login, but only the weakest one. A single phished or reused low-privilege account becomes a path to privileged functions on the system that orchestrates your SD-WAN edges.
  • Repeat targeting. Three exploited VCO bugs in roughly four months show that attackers are actively studying this product. Unpatched orchestrators will keep getting hit.

What to do

  1. Patch now. Upgrade Collabora's built-in CODE server to 26.4.303 or later. Move on-premises VeloCloud Orchestrator to 5.2.3.18, 6.1.3.10 or 6.4.2.12 (or newer) for your branch.
  2. Check if you're already compromised. On Nextcloud hosts, look for unexpected PHP files and web shells, especially around the richdocumentscode app directory, and review requests to proxy.php. On VCO, review authentication and audit logs for unusual activity from read-only accounts.
  3. Hunt for the published indicators. Search firewall, proxy and VCO logs for connections from the two IP addresses above.
  4. Reduce exposure. Keep the VCO web interface off the public internet and behind VPN or allow-listing. Audit and trim low-privilege accounts, and enforce MFA.
  5. Rotate secrets stored on, or reachable from, any server you can't rule out as compromised.
  6. Close the window. Find out where these products run before attackers do. Our vulnerability scanning service continuously checks your internet-facing systems against known-exploited CVEs like these two, so an unpatched Nextcloud or orchestrator is flagged and prioritised the moment it becomes a live risk.
SHARE