Cybersecurity
CISA adds exploited Collabora and Arista flaws to KEV
CISA listed two critical vulnerabilities in Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator after reports of active exploitation, while Arista gave limited details on the VeloCloud activity.
- CISA added CVE-2026-110447 and CVE-2026-114625 to its Known Exploited Vulnerabilities catalogue on Friday.
- The Collabora issue affected Collabora Online Built-in CODE Server used with the NextCloud platform, while the Arista issue affected on-premise versions of VeloCloud Orchestrator.
- The article said CVE-2026-110447 had been used to place web shells on Nextcloud servers and search for credentials, password-manager data and cryptocurrency wallets.
- Arista said CVE-2026-114625 was known to be actively exploited, but it did not name a threat actor or say how many organisations were affected.
- The piece said Federal Civilian Executive Branch agencies were advised to patch by 26 October 2026, and that Arista had linked two IP addresses in Japan to the activity.
CISA added two critical vulnerabilities to its Known Exploited Vulnerabilities list on Friday after reports that both were being used in the wild. The entries were CVE-2026-110447, affecting Collabora Online Built-in CODE Server, and CVE-2026-114625, affecting Arista VeloCloud Orchestrator.
The article said CVE-2026-110447 could permit remote code execution through proxy.php when the local document server was not running. It also said the flaw had been fixed in September 2026 in version 26.4.303.
For CVE-2026-114625, the piece said an attacker needed network access to the VCO web interface and a valid authenticated session, with the Enterprise Read Only role as the minimum required. It said Arista had not given technical detail on the exploitation or identified the actor behind it.
Arista said the issue was known to be actively exploited, but it did not say how many organisations were affected. The company shared two IP addresses geolocated to Japan as tied to the activity, and the article said the flaw was the third in the same product to be weaponised since July 2026.
Named in this story
Companies
- Arista
- said the VeloCloud flaw was known to be actively exploited
Governments and agencies
- CISA
- added the two flaws to its Known Exploited Vulnerabilities list
- Federal Civilian Executive Branch (FCEB) agencies
- were told to apply the fixes by 26 October 2026
Products and systems
- Collabora Online Built-in CODE Server
- had a command-injection flaw when used with NextCloud
- Arista VeloCloud Orchestrator
- had an SQL injection flaw in on-premise versions
- NextCloud platform
- was the platform where the Collabora component ran
- CVE-2026-110447
- was the Collabora vulnerability cited as actively exploited
- CVE-2026-114625
- was the Arista vulnerability cited as actively exploited
Places
- Japan
- was where Arista said two related IP addresses were geolocated
How the source tells it
The piece was largely factual, with mild urgency created by active-exploitation claims and a near-term remediation deadline.
- urgency active-exploitation reporting and a fixed patch deadline compressed the timetable