The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after reports of active exploitation. Both flaws carry very high CVSS scores and have been observed in real-world attacks, prompting public advisories and vendor patches in September and October 2026.
The vulnerabilities at a glance
CVE-2026-110447 (CVSS 9.2) — An operating system command injection in Collabora Online’s Built-in CODE Server (richdocumentscode) when used within Nextcloud. The issue can allow remote code execution via proxy.php when the CODE local document server is not running. Collabora released a fix in September 2026 in version 26.4.303.
CVE-2026-114625 (CVSS 9.9) — An SQL injection in on-premises Arista VeloCloud Orchestrator (VCO) that can enable remote attackers to access privileged internal functionality. Patches were released in October 2026 in versions 5.2.3.18, 6.1.3.10, and 6.4.2.12.
Exploitation observed in the wild
Reports indicate threat actors have exploited CVE-2026-110447 to backdoor Nextcloud servers with web shells. Attackers used those footholds to perform reconnaissance and search for credential stores, password-manager artifacts, and cryptocurrency wallets.
For CVE-2026-114625, successful exploitation requires network access to the VCO web interface along with a valid authenticated session on the portal; the minimum user role required is Enterprise Read Only. Arista has acknowledged active exploitation but has not attributed the activity to a specific actor or detailed post-exploitation behavior. The company shared two IP addresses geolocated to Japan — 74.82.197[.]86 and 38.54.50[.]151 — as associated with the observed activity.
Context and prior VeloCloud incidents
CVE-2026-114625 represents the third vulnerability in Arista VeloCloud to be weaponized since July 2026, following two earlier critically rated issues (CVE-2026-16812 and CVE-2026-93952, both with CVSS 10.0). Arista has not disclosed how many organizations were affected by the latest activity.
Vendor actions and recommended fixes
Collabora addressed the CODE Server issue with the September 2026 release 26.4.303. Arista issued fixes for VCO in October 2026 in versions 5.2.3.18, 6.1.3.10, and 6.4.2.12. Given the active exploitation, Federal Civilian Executive Branch (FCEB) agencies were specifically recommended to apply the available fixes by October 26, 2026.
What organizations should note
These incidents underscore that public-facing management and collaborative platforms remain attractive targets for attackers seeking persistent access and sensitive artifacts. Organizations running Nextcloud with the built-in CODE Server or on-premises Arista VeloCloud Orchestrator should verify their versions against the patched releases cited above and apply vendor updates where applicable. Network access controls and monitoring of administrative portals remain relevant considerations given the access requirements observed in the VCO exploitation.
Licensed under CC BY-ND 4.0 International