Two actively exploited vulnerabilities affecting Nextcloud’s built-in Collabora document server and Arista’s VeloCloud Orchestrator now appear in CISA’s Known Exploited Vulnerabilities catalog, with October 26, 2026, remediation dates and forensic triage requirements.
CISA’s catalog records October 23 additions for CVE-2026-110447 and CVE-2026-114625. Their exploitation requirements differ: the Collabora flaw permits unauthenticated command execution while its document server is stopped; the VeloCloud flaw lets an authenticated portal user obtain operator privileges.
Nextcloud app requires an upgrade or removal
For Nextcloud administrators, simply disabling the Collabora Online – Built-in CODE Server app does not address CVE-2026-110447. The remedy is to remove the app or update richdocumentscode to version 26.4.303 or later, according to Collabora’s October 14 advisory.
Versions below 26.4.303 contain an operating system command injection vulnerability in proxy.php. Without authenticating, an attacker can submit a request that runs a command with the web server user’s permissions. Collabora rates the flaw critical, with a CVSS v4 score of 9.2.
The necessary condition is that the built-in CODE server has stopped running. A container restart, an upgrade or a crash can create that opportunity. Standalone Collabora Online servers fall outside the affected scope.
Collabora separately directs users of end-of-life Nextcloud versions 29 and earlier to upgrade Nextcloud or remove the app. It also warns that the patch for CVE-2025-66208 does not block this attack because the vulnerabilities involve different paths.
The consequences extend beyond the ability to execute commands. The Hacker News reports that attackers have used CVE-2026-110447 to plant web shells on Nextcloud servers, then perform reconnaissance and look for credential stores, password manager artifacts and cryptocurrency wallets.
VeloCloud fixes depend on deployment and release train
Arista’s response distinguishes customer-operated VeloCloud Orchestrator installations from hosted services. Hosted deployments, including Dedicated instances, were vulnerable but have already received patches, the company says.
For on-premises VCO, Arista’s Security Advisory 0199 specifies these upgrade boundaries:
- 5.2.x: versions before 5.2.3.18 are affected; fixes begin at 5.2.3.18 in the 5.2 train.
- 6.1.x: versions before 6.1.3.10 are affected; fixes begin at 6.1.3.10 in the 6.1 train.
- 6.4.x: versions before 6.4.2.12 are affected; fixes begin at 6.4.2.12 in the 6.4 train.
End-of-support versions have not been assessed. Customers outside supported release trains can contact Arista’s Technical Assistance Center about upgrade options. VeloCloud Edge and VeloCloud Gateway are unaffected.
Published October 22, the advisory says Arista detected CVE-2026-114625 and knows it is being actively exploited. The SQL injection flaw scores 9.9 under CVSS v3.1 and 9.4 under CVSS v4.0.
Exploitation requires both connectivity to the VCO web interface and a valid authenticated portal session. Even Enterprise Read Only, the lowest built-in tenant role, provides sufficient access. An attacker can escalate to operator privileges, impersonate a local “superuser operator” and reach functionality intended solely for internal use. Arista says the resulting access may compromise the confidentiality, integrity and availability of the orchestrator and its managed data, as well as affect the VCO host.
Arista describes VCO as exposed by default and says no configuration prevents the exposure. Pending an upgrade, it recommends limiting web interface access to trusted administrative networks, checking for unexpected outbound traffic, backdoor daemons and webshells, and examining recent administrator activity.
The company identifies 74.82.197.86 and 38.54.50.151 as sources observed conducting attacks. It recommends blocking those addresses and searching access logs for them. Other investigation signals include unusual URL-like path components, encoded characters, references to internal or local services, and high request rates. Where compromise is suspected, Arista advises preserving web access, backend application, system and database logs, along with relevant file-system timestamps, before remediation when operationally feasible.
The federal response includes checking for compromise alongside mitigation. Both catalog entries invoke BOD 26-04, whose obligations apply to Federal Civilian Executive Branch agencies and account for each asset’s exposure and risk. CISA’s forensic triage guidance calls for preserving evidence before system changes or patching where possible. Both entries list ransomware campaign use as unknown.
