Summary Points
- CISA added two actively exploited critical flaws to its KEV catalog: Collabora CODE (CVE-2026-110447, CVSS 9.2) and Arista VeloCloud Orchestrator (CVE-2026-114625, CVSS 9.9).
- The Collabora flaw enables remote code execution; attackers have used it to backdoor Nextcloud servers and hunt for credentials, password-manager data, and crypto wallets.
- The Arista SQL injection can expose privileged functionality; exploitation requires access to the VCO web interface and an authenticated account with at least Enterprise Read Only access.
- Both vendors have issued fixes. Federal agencies were urged to patch by October 26, 2026; Arista says the activity is ongoing but has shared few details.
Attackers target collaboration and network tools
CISA has flagged two critical vulnerabilities after reports that attackers are exploiting them. The flaws affect Collabora Online’s built-in CODE server, used with Nextcloud, and Arista’s on-premises VeloCloud Orchestrator.
The Collabora flaw, CVE-2026-110447, can let a remote attacker run commands on a vulnerable server under certain conditions. Attackers have used it to install web shells on Nextcloud servers and search for credentials, password-manager data, and cryptocurrency wallets. Collabora fixed the issue in version 26.4.303 in September.
The Arista flaw, CVE-2026-114625, involves a weakness in the VeloCloud Orchestrator’s database queries. An attacker needs network access to its web interface and a valid account, even one with the limited Enterprise Read Only role. Arista fixed the flaw in versions 5.2.3.18, 6.1.3.10, and 6.4.2.12.
Updates can limit exposure
Arista has confirmed active exploitation but has not identified the attackers or explained what they did after gaining access. The company also has not said how many organizations may be affected. It shared two IP addresses linked to the activity, both geolocated to Japan.
CISA urged federal civilian agencies to install the fixes by Oct. 26, 2026. That deadline has passed. Other organizations that use these products should check their versions and apply the relevant updates. These tools help people share documents and manage networks, so protecting them also helps keep everyday work and services reliable.
Continue Your Tech Journey
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Access comprehensive resources on technology by visiting Wikipedia.
CyberAttacks-V1
