CISA warns of active exploits in Collabora Online and Arista VeloCloud

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged two critical security flaws for immediate attention after confirming they are being actively exploited by threat actors. On Friday, October 24, 2026, the agency added vulnerabilities affecting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator to its Known Exploited Vulnerabilities catalog. This designation signals that attacks are ongoing and urges organizations to prioritize remediation.

What happened

The first vulnerability, tracked as CVE-2026-110447, affects the Collabora Online Built-in CODE Server, often referred to as richdocumentscode, when integrated with the Nextcloud platform. This flaw is an operating system command injection issue with a CVSS severity score of 9.2. It allows remote code execution through the "proxy.php" component specifically when the local CODE document server is not running. The vendor released a fix in September 2026 with version 26.4.303, but unpatched instances remain at high risk.

Attackers are leveraging this weakness to install web shells on compromised Nextcloud servers. Once inside, they perform reconnaissance to locate sensitive data, including credential stores, password manager artifacts, and cryptocurrency wallets. This pattern suggests financially motivated actors or espionage groups seeking persistent access and valuable digital assets stored within self-hosted environments.

The second flaw, CVE-2026-114625, impacts on-premise installations of the Arista VeloCloud Orchestrator (VCO). With a near-perfect CVSS score of 9.9, this SQL injection vulnerability permits remote attackers to access privileged internal functions. Exploitation requires network access to the VCO web interface and a valid authenticated session, with the minimum required role being Enterprise Read Only. Arista addressed this in October 2026 via versions 5.2.3.18, 6.1.3.10, and 6.4.2.12.

Key details

• CVE-2026-110447 (CVSS 9.2) enables remote code execution in Collabora Online Built-in CODE Server for Nextcloud if the local server is down.
• Threat actors use this flaw to deploy web shells and hunt for credentials, password manager data, and crypto wallets on Nextcloud instances.
• CVE-2026-114625 (CVSS 9.9) is an SQL injection bug in Arista VeloCloud Orchestrator allowing access to privileged internal functionality.
• Exploiting the Arista flaw requires network access and a valid session with at least Enterprise Read Only permissions.
• Arista identified two IP addresses linked to the activity: 74.82.197[.]86 and 38.54.50[.]151, both geolocated to Japan.
• Federal Civilian Executive Branch agencies must apply fixes by October 26, 2026, though all users should patch immediately.

Background

CISA’s Known Exploited Vulnerabilities (KEV) catalog serves as a definitive list of flaws that adversaries are actively using in real-world attacks. Unlike theoretical risks, entries in the KEV catalog represent immediate dangers where exploit code is circulating and successful breaches are occurring. For IT leaders, this catalog helps prioritize patching efforts by highlighting which vulnerabilities pose the greatest imminent threat to infrastructure.

Command injection and SQL injection are classic attack vectors. Command injection allows an attacker to execute arbitrary system commands on the host server, effectively taking control of the machine. SQL injection manipulates database queries, potentially exposing or modifying sensitive data. In self-hosted environments like Nextcloud or enterprise networking tools like Arista VCO, these flaws can bypass perimeter defenses if the application itself is vulnerable.

Why it matters

For teams running self-hosted software, this incident underscores the operational burden of maintaining complex stacks. Nextcloud is a popular choice for organizations seeking control over their data, but integrating additional components like Collabora Online introduces new attack surfaces. When a sub-component like the CODE server fails or is misconfigured, it can open critical pathways for attackers. This highlights the need for rigorous monitoring of all integrated services, not just the core platform.

The Arista vulnerability demonstrates that even authenticated users with low-level permissions can become entry points for severe breaches. The requirement for only "Enterprise Read Only" access means that compromised employee accounts or phishing successes could lead to full system compromise. This reinforces the principle of least privilege and the importance of securing user sessions and monitoring for anomalous behavior from low-privilege accounts.

Furthermore, the rapid succession of exploited vulnerabilities in Arista VCO—three since July 2026—suggests systemic security challenges or intense scrutiny by threat actors. Organizations relying on these platforms must assume they are targeted and maintain a faster patching cadence than usual. Delaying updates even by days can result in significant data loss or unauthorized access.

What you can do

• Verify your Nextcloud instance is running Collabora Online Built-in CODE Server version 26.4.303 or later to mitigate CVE-2026-110447.
• Check if the local CODE document server is running correctly; ensure it does not fall back to vulnerable proxy methods unexpectedly.
• Update Arista VeloCloud Orchestrator to version 5.2.3.18, 6.1.3.10, or 6.4.2.12 immediately to patch CVE-2026-114625.
• Review logs for connections from IP addresses 74.82.197[.]86 and 38.54.50[.]151, and block them if not legitimate traffic.
• Audit user accounts with Enterprise Read Only access in Arista VCO and enforce multi-factor authentication to prevent session hijacking.
• Scan Nextcloud servers for unknown web shells or unusual processes, particularly looking for signs of reconnaissance activity in credential stores.