CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
CISA has added two critical vulnerabilities, CVE-2026-110447 in Collabora Online and CVE-2026-114625 in Arista VeloCloud Orchestrator, to its Known Exploited Vulnerabilities catalog due to active exploitation in the wild.
Intelligence analysis by Gemini 2.5 Flash
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding two critical-severity flaws, one affecting Collabora Online's CODE Server and another in Arista VeloCloud Orchestrator, both of which are being actively exploited by threat actors.
Imagine your computer is like a house, and these two problems are like unlocked windows or doors that bad guys have found and are already using to sneak in. One problem is in a tool that helps you edit documents online, and the other is in a system that manages computer networks. The government is telling everyone to quickly lock these windows and doors by updating their software so the bad guys can't get in and snoop around or steal things.
Analysis
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert, adding two actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. This move underscores the immediate and severe threat these flaws pose to organizations, particularly those within the Federal Civilian Executive Branch (FCEB) agencies, which are mandated to apply fixes promptly. The vulnerabilities, identified as CVE-2026-110447 and CVE-2026-114625, represent significant security gaps that threat actors are already leveraging to compromise systems and access sensitive data. The proactive flagging by CISA serves as a crucial warning, urging all affected entities to prioritize patching to prevent further damage and maintain network integrity.
Collabora Online
The first vulnerability, CVE-2026-110447, carries a CVSS score of 9.2 and impacts the Collabora Online Built-in CODE Server, specifically when integrated with the Nextcloud platform. This flaw is an operating system command injection vulnerability that could enable remote code execution through the "proxy.php" component if the CODE local document server is not operational. Threat actors have been observed actively exploiting this weakness to install web shells on Nextcloud servers.
Once a web shell is established, attackers can conduct extensive reconnaissance, searching for critical information such as credential stores, password manager artifacts, and cryptocurrency wallets. Collabora addressed this vulnerability in September 2026 with the release of version 26.4.303, making it imperative for users to update their installations to mitigate the risk of compromise.
Arista VeloCloud Orchestrator
The second critical vulnerability, CVE-2026-114625, affects on-premise versions of the Arista VeloCloud Orchestrator (VCO) and boasts an even higher CVSS score of 9.9. This SQL injection vulnerability allows a remote attacker to gain access to privileged internal functionality within the VCO. Successful exploitation requires the attacker to have network access to the VCO web interface and a valid authenticated session, even with a minimum user role like "Enterprise Read Only."
Arista has confirmed the active exploitation of this vulnerability, although specific details regarding the threat actors or their post-exploitation actions have not been publicly disclosed. The company did, however, identify two IP addresses geolocated to Japan as being responsible for the malicious activity. This vulnerability is particularly concerning as it marks the third flaw in the Arista VeloCloud Orchestrator product to be weaponized in the wild since July 2026, following CVE-2026-16812 and CVE-2026-93952, both with CVSS scores of 10.0. Patches for CVE-2026-114625 were released in October 2026 across versions 5.2.3.18, 6.1.3.10, and 6.4.2.12.
Federal Civilian Executive Branch
CISA's inclusion of these vulnerabilities in its KEV catalog triggers a mandatory directive for Federal Civilian Executive Branch (FCEB) agencies. These agencies are strongly recommended to apply the necessary fixes for both CVE-2026-110447 and CVE-2026-114625 by October 26, 2026. This deadline highlights the urgency of the situation, emphasizing the potential for significant government network compromise if patches are not deployed promptly.
The directive aims to secure critical government infrastructure against known and actively exploited threats, preventing potential data exfiltration, service disruption, and unauthorized access. The repeated exploitation of vulnerabilities in widely used software underscores the ongoing challenge of maintaining robust cybersecurity postures in the face of persistent and evolving threat landscapes.
Key points
- CISA added two critical vulnerabilities, CVE-2026-110447 and CVE-2026-114625, to its KEV catalog due to active exploitation.
- CVE-2026-110447 affects Collabora Online Built-in CODE Server and allows remote code execution via command injection.
- CVE-2026-114625 affects on-premise Arista VeloCloud Orchestrator and allows privileged internal functionality access via SQL injection.
- Threat actors are actively exploiting CVE-2026-110447 to backdoor Nextcloud servers for reconnaissance and data theft.
- Federal Civilian Executive Branch agencies are recommended to apply the fixes by October 26, 2026.
The prompt and timely flagging by CISA, coupled with the availability of patches from Collabora and Arista, provides a clear path for organizations to secure their systems. Rapid adoption of these fixes by Federal Civilian Executive Branch agencies and other entities can significantly mitigate the risk of further exploitation and protect sensitive data.
Despite the availability of patches, organizations that delay applying these critical updates remain highly vulnerable to active exploitation, potentially leading to widespread data breaches, system compromise, and significant operational disruptions. The ongoing exploitation of Arista VeloCloud Orchestrator vulnerabilities highlights a persistent challenge in timely patch management.
