CISA Adds Actively Exploited Flaws in Collabora Online and Arista VeloCloud to KEV

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two flaws to its Known Exploited Vulnerabilities (KEV) catalog — one in Collabora Online Built-in CODE Server and one in Arista VeloCloud Orchestrator (VCO). The move follows reports of active exploitation in the wild.

Two critical flaws

The first, CVE-2026-110447 (CVSS 9.2), is an operating system command injection flaw in Collabora Online Built-in CODE Server (aka richdocumentscode) when used inside the NextCloud platform. It allows remote code execution via proxy.php when the CODE local document server isn't running. A fix shipped in September 2026 in version 26.4.303.

The second, CVE-2026-114625 (CVSS 9.9), is an SQL injection flaw in on-premise versions of Arista VeloCloud Orchestrator that lets a remote attacker reach privileged internal functionality. It was patched in October 2026 in versions 5.2.3.18, 6.1.3.10, and 6.4.2.12.

How they are being abused

According to The Hacker News, threat actors have been exploiting CVE-2026-110447 to drop a web shell on Nextcloud servers. From there they run reconnaissance and hunt for credential stores, password-manager artifacts, and cryptocurrency wallets.

Exploiting CVE-2026-114625 requires the attacker to have network access to the VCO web interface and a valid authenticated session on the portal. The minimum user role needed is Enterprise Read Only.

Arista has acknowledged that the vulnerability is "known to be actively exploited," but it has not attributed the activity to any particular threat actor and has shared no technical detail — neither how the flaw is being exploited nor what attackers did after privilege escalation. The company also did not disclose how many organizations were affected. It did, however, list two IP addresses geolocated to Japan as driving the activity: 74.82.197[.]86 and 38.54.50[.]151.

CVE-2026-114625 is the third flaw in the same product weaponized in the wild since July 2026, following CVE-2026-16812 and CVE-2026-93952, both rated CVSS 10.0.

Given the active exploitation, U.S. Federal Civilian Executive Branch (FCEB) agencies have been told to apply the fixes by October 26, 2026.

Source: The Hacker News