CISA adds Collabora Online and Arista VeloCloud flaws to its exploited list: what to patch

On 23 October 2026 the US cyber agency CISA added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog because of evidence of active exploitation. If you run Nextcloud with the built-in Collabora server, or an on-premises Arista VeloCloud Orchestrator, check both today.

This is based on news reports (The Hacker News, Security Affairs and others). We could not open CISA's catalog entries or the vendor advisories in full, so figures below are as reported. Confirm them on CISA's KEV page and the vendors' advisories before acting.

Collabora Online: CVE-2026-110447

• What: an operating system command injection in the Collabora Online Built-in CODE Server (the richdocumentscode app used with Nextcloud). Reported to allow remote code execution through proxy.php when the local document server is not running.
• Severity: CVSS 9.2 (critical).
• Fixed in: version 26.4.303, released in September, per one report.
• Exploitation: one report says attackers have placed web shells on Nextcloud servers and searched them for credential stores, password-manager files and cryptocurrency wallets. We saw this in only one source.

What to do: update the Collabora Online app (or the built-in server) to 26.4.303 or later. If you cannot update now, disable the built-in server and use a separately maintained Collabora instance, and look for unexpected PHP files in the app's directories.

Arista VeloCloud Orchestrator: CVE-2026-114625

• What: an SQL injection in on-premises VeloCloud Orchestrator (VCO). Any authenticated user can gain operator privileges and impersonate a local superuser operator account, Arista's advisory says. Reports add that the lowest permission level is enough.
• Severity: reported as CVSS 9.4 by one outlet and 9.9 by another, so scores differ by scoring version.
• Exposure: on-premises VCO is vulnerable by default. Hosted versions, including Dedicated, were affected and have already been patched. No configuration change prevents the exposure, reports say.
• Exploitation: Arista says it is aware of active exploitation but has not named an attacker. One report counts this as the third exploited VCO flaw in about four months.

What to do: apply Arista's fix for on-premises VCO (see its security advisory), limit who can sign in and where from, and review operator accounts and recent logins.

The deadline

CISA's KEV catalog gives US federal agencies a date to fix each flaw. One report gives 26 October for these two, which is shorter than usual, and we could not confirm it. Whatever the official date, anything in KEV is being used in real attacks, so treat it as urgent even if you are not a federal agency.

How to use KEV for your own patching

1. Subscribe to CISA's KEV feed and check it against your software list each week.
2. Patch KEV items before other critical-rated bugs. "Exploited" matters more than a high score.
3. Keep an asset list that includes network appliances and add-on apps, which are often forgotten.
4. For anything exposed to the internet, assume attackers will scan for the bug within days.

Update log

• 25 October 2026: first published from news reports of CISA's 23 October addition. CVSS scores and the deadline differ between sources and are flagged above. We will update when we confirm them against CISA and the vendors.

Cover photo: Dsimic, CC BY-SA 4.0, via Wikimedia Commons.