CISA KEV Collabora Arista Vulnerabilities Explained: Two Actively Exploited Flaws With a 26 October Deadline (World Tech)
Image: Wikimedia Commons (CC0, NERSC) — server racks in a data centre (illustrative image; no product photo exists for a vulnerability disclosure, so this is not a picture of either affected product)
Update — 25 October 2026: the 26 October remediation deadline is now tomorrow. If you run Nextcloud with the Built-in CODE Server app or an on-prem VeloCloud Orchestrator and have not patched yet, do it today — both flaws remain actively exploited.
📌 KEY HIGHLIGHTS
- Added to CISA KEV on 23 October 2026: both flaws carry evidence of active exploitation in the wild — KEV listing is about confirmed abuse, not just severity.
- Collabora flaw — CVE-2026-110447 (CVSS 9.2): operating-system command injection in the Built-in CODE Server used with Nextcloud; fixed in version 26.4.303.
- Arista flaw — CVE-2026-114625 (CVSS 9.9): SQL injection in on-premises VeloCloud Orchestrator; even the lowest-privilege account can reach superuser-operator powers. Fixed in 5.2.3.18, 6.1.3.10 and 6.4.2.12.
- Deadline 26 October 2026: an unusually short three-day clock for US federal civilian agencies, with forensic triage required. Known ransomware use: unknown for both entries.
- Attack fingerprints: Nextcloud intruders plant web shells and hunt password-manager files and crypto wallets; Arista shared two attack-source IPs geolocated to Japan.
What happened?
The US Cybersecurity and Infrastructure Security Agency (CISA) updates its Known Exploited Vulnerabilities (KEV) catalog only when it has evidence that attackers are actually exploiting a flaw — it is the closest thing the industry has to a "patch this first" list. On 23 October 2026, two new entries landed at once, both rated critical, both already weaponised. For federal civilian agencies the entries come with a due date of 26 October 2026 under Binding Operational Directive 22-01 — three days, not the usual three weeks — plus a forensic-triage requirement, a sign of how seriously CISA views confirmed exploitation. Private organisations are not bound by the directive, but CISA's advice to them is the same: prioritise KEV entries above everything else in the queue.
The two flaws hit very different corners of enterprise IT — a self-hosted office suite and a network control plane — but they share the same lesson: internet-facing management software with an injection bug becomes a front door, and attackers are already walking through both.
CISA KEV Collabora Arista vulnerabilities explained: the two flaws
| Flaw | Product | Bug type | Severity | Fixed version |
|---|---|---|---|---|
| CVE-2026-110447 | Collabora Online Built-in CODE Server (Nextcloud app richdocumentscode) | OS command injection via proxy.php | CVSS 9.2 | 26.4.303 (Sept 2026) |
| CVE-2026-114625 | Arista VeloCloud Orchestrator, on-premises only | SQL injection (CWE-89) | CVSS 3.1: 9.9 / 4.0: 9.4 | 5.2.3.18, 6.1.3.10, 6.4.2.12 (Oct 2026) |
The Collabora flaw (CVE-2026-110447). Collabora Online's Built-in CODE Server is the app that lets Nextcloud users edit documents in the browser without a separate office server. When the CODE local document server is not running, a crafted request to its proxy.php endpoint can inject operating-system commands and achieve remote code execution on the host. The flaw has been exploited in the wild since 10 September 2026 — weeks before the KEV listing. Observed attacks backdoor Nextcloud servers with a one-line PHP web shell, then go hunting: credential stores, password-manager artifacts and cryptocurrency wallets. In at least one case reported in Italy, attackers stole a configuration file holding database and mail credentials. The fix shipped in September 2026 as version 26.4.303, so any server still on an older build has been exposed to a known-exploited bug for over a month.
The Arista flaw (CVE-2026-114625). VeloCloud Orchestrator (VCO) is the central management plane for SD-WAN deployments — the console that provisions and configures branch-office network edges. The SQL-injection flaw lets any authenticated user, including one holding only the lowest Enterprise Read Only role, escalate to a local "superuser operator" and reach functionality meant to be internal-only. No configuration change can prevent exposure: if the web interface is reachable and the attacker holds any valid session, the flaw is reachable too. Arista says the flaw is "known to be actively exploited" and published two attack-source IP addresses geolocated to Japan — 74.82.197.86 and 38.54.50.151 — but has not attributed the activity to a specific actor or disclosed how many organisations are affected. Hosted and Dedicated VCO instances were already patched by the vendor; VeloCloud Gateway and Edge devices are not affected.
Image: Wikimedia Commons (CC0, NERSC) — rear of a server rack, cabling close-up (illustrative image of infrastructure of the kind these flaws target)
Why the third VeloCloud zero-day in four months matters
CVE-2026-114625 is the third VeloCloud Orchestrator vulnerability weaponised in the wild since July 2026, after CVE-2026-16812 and CVE-2026-93952 — both of which scored a perfect 10.0. A control plane is the worst place to keep finding critical bugs: whoever controls the orchestrator can see device inventories, configurations, credentials and certificates, and in Arista's own words for earlier flaws, a VCO compromise "may allow attackers access to the VeloCloud Edge devices as well." For organisations that buy SD-WAN as a managed service, the question to put to the provider today is simple: on-prem or hosted VCO, which train, and is the web UI internet-exposed? If the provider cannot answer, that is itself an answer.
What to check if you run either product
Nextcloud + Collabora admins: open Apps and check whether "Collabora Online – Built-in CODE Server" is installed — even if it is disabled, that is not enough. Update it to 26.4.303 or later, or remove it and point Nextcloud Office at a separately hosted Collabora server. On Nextcloud 29 or older, upgrade Nextcloud itself first (to 30 or later). Then hunt: look in the apps/richdocumentscode folder for PHP files that do not belong to the app, run Nextcloud's integrity check (occ integrity:check-app richdocumentscode), and search web-server logs back to 10 September for odd proxy.php requests and outbound connections to webhook-style services. Anything found means rotating the database password, mail and storage credentials and app secrets.
VeloCloud admins: confirm your on-prem train is at or above 5.2.3.18, 6.1.3.10 or 6.4.2.12 as applicable. Check web logs for unusual or encoded requests, attempts to reach internal services, or traffic from the two published IPs — and block them. If an attack is suspected, preserve web, application, system and database logs, plus file timestamps, before starting recovery: CISA's forensic-triage requirement exists because wiping first destroys the evidence of what was taken.
Why it matters for World Tech readers
Neither flaw respects borders: Nextcloud is the self-hosted cloud of choice for privacy-conscious organisations worldwide, including in India, and SD-WAN orchestrators sit at the heart of branch networks everywhere. The 26 October deadline legally binds only US federal agencies, but the exploitation behind it is global — the Collabora attacks have run since September, and the Arista attack IPs are already public. For Indian administrators, the same checks apply, and the same urgency: KEV-listed flaws are the ones attackers automate first, because they know patching lags disclosure. This is also the week to re-read the other October KEV stories on this blog — the PHP session-upload flaw and the SafePay ransomware advisory — since attackers chain exactly these kinds of known bugs into intrusions.
Should you care?
FAQs
What is CISA's Known Exploited Vulnerabilities catalog?
It is CISA's list of vulnerabilities with confirmed evidence of exploitation in the wild. US federal civilian agencies must remediate listed flaws by the stated due date; for everyone else it is the most reliable "patch first" priority list in the industry.
Is my Nextcloud affected by CVE-2026-110447?
Only if the "Collabora Online – Built-in CODE Server" app (richdocumentscode) is installed — check Apps even if it is disabled. If it is installed and below version 26.4.303, update or remove it, then check for stray PHP files and review logs back to 10 September 2026.
Which VeloCloud Orchestrator versions fix CVE-2026-114625?
On-premises VCO is fixed in 5.2.3.18, 6.1.3.10 and 6.4.2.12 (October 2026). Hosted and Dedicated VCO instances were already patched by Arista, and VeloCloud Gateway and Edge devices are not affected.
What are the attack IP addresses for the Arista flaw, and what should I do with them?
Arista published 74.82.197.86 and 38.54.50.151, geolocated to Japan, as observed attack sources. Block them, search your VCO web logs for them, and if you find a match, preserve all logs before remediation — do not wipe first.
Takeaway: Two critical flaws, both already exploited, both with fixes ready — and a three-day federal deadline that tells you everything about the urgency. Check your Nextcloud apps and your VCO version today, not next sprint.
Follow World Tech on TechByCountry for tomorrow's 6 PM update.
📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.
Sources
- CISA — Known Exploited Vulnerabilities Catalog (CVE-2026-110447 and CVE-2026-114625 entries, added 23 October 2026, due 26 October 2026)
- The Hacker News — CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud (24 October 2026)
- SecurityAffairs — US CISA adds Arista VeloCloud Orchestrator flaw to its KEV catalog (24 October 2026)
- Arista Security Advisory 0199 (CVE-2026-114625) and Collabora advisory for version 26.4.303, as reported by the sources above.
Related reading: ConnectWise cloud-backup breach by Storm-0940 — what to check
Comments
Post a Comment