CISA Warns of Active Attacks Exploiting Critical Collabora Online and Arista VeloCloud Vulnerabilities
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities affecting Collabora Online and Arista VeloCloud Orchestrator to its Known Exploited Vulnerabilities (KEV) catalog, confirming that attackers are exploiting weaknesses in enterprise collaboration and network management infrastructure.
The vulnerabilities, tracked as CVE-2026-110447 and CVE-2026-114625, affect different technologies but present serious security risks. The first allows operating system command injection in the Collabora Online integration used with Nextcloud, while the second involves SQL injection in on-premises Arista VeloCloud Orchestrator deployments. Both have received critical severity ratings, with CVSS scores of 9.2 and 9.9, respectively.
CISA's October 23, 2026, decision places the vulnerabilities among security flaws for which evidence of real-world exploitation has been identified. The agency instructed affected U.S. federal civilian executive branch organizations to apply the relevant security updates by October 26, creating an unusually short remediation window that reflects the urgency of the threat.
The warning arrives amid continued attacks against internet-facing enterprise software, particularly platforms that combine administrative privileges, access to sensitive information, and connectivity to other corporate systems. Although the two vulnerabilities involve different attack mechanisms and exploitation requirements, both demonstrate how weaknesses in widely deployed infrastructure can create opportunities for unauthorized access and subsequent compromise.
Collabora Online Vulnerability Used to Backdoor Nextcloud Servers
CVE-2026-110447 affects the Collabora Online Built-in CODE Server, also known asrichdocumentscode, when deployed as part of the Nextcloud collaboration platform. The vulnerability arises from an operating system command injection weakness that can be triggered through theproxy.phpcomponent under specific conditions.
The vulnerable code path becomes relevant when the local CODE document server is not running. In affected installations, specially crafted requests can exploit insufficient command handling to execute operating system commands on the server. The issue creates a remote code execution risk, potentially allowing attackers to move beyond the document editing component and interact directly with the underlying host environment.
Collabora Online provides browser-based editing capabilities for documents, spreadsheets, and presentations. Its integration with Nextcloud is widely used by organizations seeking self-hosted collaboration services, including environments where sensitive business information is stored outside public cloud productivity platforms.
This deployment model makes the vulnerability particularly concerning. Nextcloud installations may contain internal documents, shared files, user information, and connections to enterprise identity services. A successful compromise of the underlying server could therefore expose information unrelated to the document editing functionality originally targeted by the attacker.
Security researchers have already observed attackers exploiting CVE-2026-110447 to deploy web shells on vulnerable Nextcloud servers. These backdoors provide a mechanism for issuing additional commands after the initial intrusion and can allow attackers to maintain access while investigating the compromised environment.
The observed post-exploitation activity has included reconnaissance and searches for credential stores, password manager artifacts, and cryptocurrency wallets. These actions suggest that the attackers are interested in identifying valuable information and potential opportunities for further compromise rather than merely demonstrating that the vulnerability can be exploited.
The presence of web shells also complicates remediation. Installing a patched version of the affected component can prevent additional exploitation through the original vulnerability, but it does not automatically remove malicious files, unauthorized accounts, or other persistence mechanisms established before the update.
Organizations operating exposed Nextcloud environments must therefore consider both vulnerability remediation and the possibility of an existing compromise.
A Conditional Flaw With Serious Remote Code Execution Consequences
The Collabora Online vulnerability is notable because exploitation depends on a particular operational condition: the local CODE server must not be running. This requirement distinguishes the issue from vulnerabilities that can be triggered indiscriminately against every installation of an affected product.
Nevertheless, the condition does not eliminate the risk. Service failures, incomplete initialization, configuration differences, or other operational circumstances may expose the vulnerable code path. Attackers conducting internet-wide scanning may be able to identify installations where those conditions exist.
The vulnerability was addressed in Collabora Online Built-in CODE Server version 26.4.303, released in September 2026. Administrators using older versions should verify whether their deployment includes the affected integration and ensure that the patched component has been installed.
For organizations managing Nextcloud through application packages or automated deployment systems, updating the core Nextcloud platform alone may not be sufficient. The vulnerable functionality resides in the Collabora integration, making it important to verify the installed version ofrichdocumentscodeseparately.
Security teams should also review whether the collaboration service is accessible directly from the public internet and whether its permissions allow access to sensitive filesystem locations. Restricting unnecessary network exposure and applying least-privilege principles can help reduce the consequences of a successful application-level compromise.
However, those controls should complement rather than replace the vendor's security update. The confirmed deployment of web shells demonstrates that attackers have moved beyond theoretical exploitation and are using the flaw as an entry point into real systems.
Arista VeloCloud Orchestrator Targeted Through Critical SQL Injection
The second vulnerability, CVE-2026-114625, affects on-premises deployments of Arista VeloCloud Orchestrator, a management platform used to administer software-defined wide area networking infrastructure.
The flaw involves SQL injection that can allow an attacker to access privileged internal functionality through the VeloCloud Orchestrator web interface. It has received a CVSS score of 9.9, reflecting the potentially severe consequences of exploitation in affected environments.
Unlike the Collabora Online issue, exploitation of the VeloCloud vulnerability requires authentication. According to Arista's advisory, an attacker must have network access to the orchestrator's web interface and possess a valid authenticated session on the VCO portal. The minimum required account privilege is the Enterprise Read Only role.
This requirement is an important distinction when evaluating exposure. The vulnerability is not described as an unauthenticated internet-facing exploit. Instead, it allows an attacker who already possesses relatively limited access to potentially reach functionality that should require higher privileges.
The danger lies in the difference between the permissions granted to the authenticated user and the operations made accessible through the injection flaw. An account intended for read-only monitoring could become a pathway to privileged internal functions, undermining the separation between administrative roles.
In enterprise environments, lower-privileged credentials can be obtained through phishing, password reuse, compromised endpoints, stolen sessions, or other initial access techniques. Once attackers establish a valid session, vulnerabilities that permit privilege escalation can significantly increase the impact of that initial compromise.
Because VeloCloud Orchestrator is responsible for managing network infrastructure, unauthorized access to privileged functionality is particularly sensitive. Depending on the accessible operations and deployment configuration, an attacker could potentially interfere with management processes or gain information useful for further attacks.
Arista has not publicly disclosed the specific actions performed by attackers exploiting CVE-2026-114625, so the precise post-exploitation consequences observed in real incidents remain unknown.
Arista Confirms Exploitation and Identifies Suspicious IP Addresses
Arista has acknowledged that CVE-2026-114625 is being exploited in real-world attacks, although the company has not attributed the activity to a particular threat actor or disclosed the number of organizations affected.
The vendor identified two IP addresses associated with suspicious activity:
74.82.197[.]8638.54.50[.]151
Both addresses were reported as geolocated to Japan. Their geographic association should not be interpreted as evidence that the attackers are based in Japan, since threat actors frequently route operations through rented infrastructure, compromised servers, and intermediary networks.
The indicators provide security teams with useful starting points for investigating potentially malicious connections to VeloCloud Orchestrator interfaces. However, relying exclusively on these addresses would be insufficient because attackers can change infrastructure, use additional systems, or exploit the vulnerability through other network paths.
Organizations should correlate the indicators with authentication logs, web access records, administrative activity, and unexpected requests to the management interface. Particular attention should be given to activity originating from lower-privileged accounts that appears inconsistent with their normal operational responsibilities.
Arista released fixes in VeloCloud Orchestrator versions 5.2.3.18, 6.1.3.10, and 6.4.2.12. Administrators should identify the appropriate supported release for their deployment and verify that the updated version has been installed.
Where immediate remediation is not possible, restricting access to the orchestrator's management interface can reduce exposure. Management portals should be accessible only through authorized administrative networks or other controlled access mechanisms, rather than being unnecessarily exposed to the public internet.
Because exploitation requires an authenticated session, organizations should also review access to low-privilege VCO accounts. Read-only credentials should not be treated as harmless when an actively exploited vulnerability allows those accounts to reach privileged internal functionality.
Third Actively Exploited VeloCloud Vulnerability Since July
The latest VeloCloud warning is particularly significant because CVE-2026-114625 is the third vulnerability affecting the same product to be exploited in the wild since July 2026.
The two earlier vulnerabilities, CVE-2026-16812 and CVE-2026-93952, both received maximum CVSS scores of 10.0. Their exploitation placed VeloCloud Orchestrator among the enterprise management platforms facing repeated attention from attackers during the second half of the year.
The recurrence of critical vulnerabilities does not establish that the incidents are connected or that the same attackers are responsible. Nevertheless, it increases the importance of reviewing the security posture of affected deployments beyond the latest individual patch.
Network management systems are attractive targets because they occupy privileged positions within enterprise environments. They frequently maintain information about network topology, connectivity, operational policies, and administrative relationships between distributed sites.
Compromising such a system can provide attackers with valuable visibility into the organization, even when the initial vulnerability does not directly grant unrestricted control over every managed device.
For defenders, repeated exploitation affecting a management platform should trigger a broader assessment of its exposure, authentication controls, patching practices, and monitoring coverage.
Organizations should determine whether previous vulnerabilities were remediated promptly and whether historical logs reveal suspicious activity that may have gone undetected. The absence of current alerts does not necessarily establish that earlier exploitation attempts were unsuccessful.
CISA's KEV Catalog Signals Confirmed Exploitation
CISA's Known Exploited Vulnerabilities catalog is designed to identify security flaws supported by evidence of exploitation in real-world environments. Inclusion in the catalog provides a stronger indication of immediate operational risk than a severity score alone.
A vulnerability can receive a critical CVSS rating because of its potential technical impact without any confirmed evidence that attackers are exploiting it. KEV inclusion adds a different dimension to prioritization: the vulnerability is no longer merely a theoretical possibility, but part of observed adversarial activity.
This distinction is particularly important for organizations managing large vulnerability backlogs. Security teams frequently encounter thousands of findings across endpoints, servers, cloud services, and network appliances. Prioritizing actively exploited vulnerabilities can help focus remediation resources on weaknesses presenting demonstrated threats.
For CVE-2026-110447 and CVE-2026-114625, CISA established an October 26, 2026, remediation deadline for affected Federal Civilian Executive Branch agencies under the requirements associated with Binding Operational Directive 22-01.
The deadline applies to the covered federal organizations, but private-sector enterprises can use the same information to inform their own risk assessments. Organizations operating affected Nextcloud or VeloCloud infrastructure should not interpret the absence of a federal mandate as evidence that remediation can safely be delayed.
The agency's action also demonstrates why vulnerability prioritization must consider exploitability and exposure together. The Collabora Online flaw provides a remote command execution pathway under specific service conditions, while the VeloCloud issue requires an authenticated session but can undermine privilege boundaries within sensitive network management infrastructure.
Both scenarios warrant urgent attention, although the investigation and containment measures appropriate for each differ.
Why Patching Alone May Not Resolve an Existing Compromise
The confirmed exploitation of the Collabora Online vulnerability introduces an important incident response consideration. Attackers have reportedly used the flaw to install web shells and search compromised systems for valuable infor