CISA adds exploited Collabora and Arista VeloCloud flaws to KEV

The U.S. Cybersecurity and Infrastructure Security Agency has added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog after reports of active exploitation. The entries affect Collabora Online Built-in CODE Server and on-premise Arista VeloCloud Orchestrator, with CVSS scores of 9.2 and 9.9 respectively.

CVE-2026-110447 is an operating system command injection flaw in Collabora Online’s Built-in CODE Server, also known as richdocumentscode. When it is used with the Nextcloud platform and the local CODE document server is not running, a remote attacker could achieve code execution through proxy.php.

CVE-2026-114625 is an SQL injection vulnerability in on-premise deployments of Arista VeloCloud Orchestrator. It could allow a remote attacker to access privileged internal functionality. Both vulnerabilities now appear in CISA’s KEV catalog because exploitation has been observed in the wild.

Nextcloud servers targeted with web shells

Threat actors have exploited CVE-2026-110447 to backdoor Nextcloud servers with web shells. The reported post-compromise activity included reconnaissance and searches for credential stores, password-manager artifacts, and cryptocurrency wallets.

Collabora fixed the issue in September 2026 with version 26.4.303. Organizations running the affected integration should establish whether the Built-in CODE Server is deployed within Nextcloud, confirm the installed version, and examine systems for unauthorized files or evidence of web-shell activity.

Authenticated access required for VCO attack

Exploitation of CVE-2026-114625 requires network access to the VCO web interface and a valid authenticated VCO portal session. The minimum required role is Enterprise Read Only. Arista has said the flaw is known to be actively exploited, but has not attributed the activity, described the exploitation method, or disclosed the number of affected organizations.

Arista identified two IP addresses geolocated to Japan in connection with the activity: 74.82.197[.]86 and 38.54.50[.]151. The vulnerability is the third VeloCloud Orchestrator issue weaponized in the wild since July 2026, following CVE-2026-16812 and CVE-2026-93952, both rated CVSS 10.0.

Patch and exposure review should be immediate

Arista addressed CVE-2026-114625 in versions 5.2.3.18, 6.1.3.10, and 6.4.2.12. CISA recommended that Federal Civilian Executive Branch agencies apply the fixes by October 26, 2026.

For businesses, the immediate implication is to patch affected Collabora and VCO installations, restrict access to VCO web interfaces, review active portal sessions and privileges, and investigate Nextcloud environments for indicators consistent with web-shell deployment.