CISA moves two high-severity flaws onto the KEV list
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-110447 and CVE-2026-114625. Both are rated critical by their CVSS scores — 9.2 for the Collabora/Nextcloud issue and 9.9 for the Arista VeloCloud Orchestrator (VCO) flaw — and CISA cited reports of active exploitation in the wild as the reason for the listing.
CVE-2026-110447 — Collabora Online / Nextcloud: command injection and web shells
CVE-2026-110447 is an operating-system command injection vulnerability in Collabora Online’s Built-in CODE Server (also known as richdocumentscode) when used inside the Nextcloud platform. The vulnerability can allow remote code execution via "proxy.php" specifically when the CODE local document server is not running. The issue was fixed in September 2026 in Collabora version 26.4.303.
Reporting by The Hacker News says threat actors have used this vulnerability to backdoor Nextcloud servers with a web shell. According to that reporting, attackers who gained access then conducted reconnaissance and searched target systems for credential stores, password manager artifacts, and cryptocurrency wallets.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadCVE-2026-114625 — Arista VeloCloud Orchestrator: SQL injection in on‑prem VCO
CVE-2026-114625 is an SQL injection vulnerability affecting on-premise versions of Arista VeloCloud Orchestrator (VCO) that could allow a remote attacker to access privileged internal functionality. Patches were issued in October 2026 in versions 5.2.3.18, 6.1.3.10, and 6.4.2.12.
Successful exploitation requires network access to the VCO web interface and a valid authenticated session on the VCO portal; the minimum user role required to exploit the flaw is Enterprise Read Only. Arista has acknowledged that the vulnerability is "known to be actively exploited," but the company has not attributed the activity to any particular threat actor or provided technical details on post-exploitation actions or how many organizations were affected.
Arista did, however, share two IP addresses geolocated to Japan that it said were responsible for driving the activity. The company also noted CVE-2026-114625 is the third vulnerability in the same product to be weaponized in the wild since July 2026, following CVE-2026-16812 and CVE-2026-93952, both scored at 10.0.
What this means for FCEB security teams, Nextcloud operators, and VeloCloud administrators
- FCEB security teams: CISA’s advisory imposes an operational deadline — apply the supplied fixes by October 26, 2026 — which demands inventory, patch testing, and prioritized rollout across federal networks before that date.
- Nextcloud operators and Collabora users: systems running the Built-in CODE Server should verify whether the CODE local document server can be reached and install Collabora version 26.4.303 (or later) where appropriate; operators that observe web-shell artifacts should begin forensic collection and credential-harvest remediation per their incident-response plans.
- VeloCloud administrators and on-prem VCO owners: because exploitation requires authenticated access and an Enterprise Read Only account, administrators should audit account usage, tighten network access to the VCO web interface, and apply Arista’s October 2026 fixes (5.2.3.18, 6.1.3.10, 6.4.2.12) while investigating the two IP addresses Arista provided.
Operational implications and open questions
Two practical points stand out from the record released so far. First, the Collabora/Nextcloud activity reported by The Hacker News shows how a single remote code execution vector can be leveraged to plant web shells and hunt for high-value artifacts such as credential stores and cryptocurrency wallets. Second, Arista’s public acknowledgement of active exploitation combined with the disclosure of two geolocated IPs supplies some operational indicators but leaves attribution and scope unanswered — the company has not detailed what attackers did after privilege escalation nor how many customers were impacted.
With CISA’s deadline now public, organizations that host Nextcloud with Collabora Built-in CODE Server or run on‑prem Arista VCO face a compressed timeline: verify exposure, install the specific patched versions cited by the vendors, and hunt for signs of compromise. Meanwhile, the two CVEs join a string of recent weaponizations of VCO vulnerabilities, signaling that defenders should treat VCO interfaces as high-risk attack surfaces until patches are widely deployed.
