CISA KEV Adds Collabora and Arista VeloCloud Flaws Under Attack

CISA's KEV catalog now lists CVE-2026-110447 in Collabora Online's Built-in CODE Server for Nextcloud and CVE-2026-114625 in on-premise Arista VeloCloud Orchestrator. Both are critical and both are exploited in the wild. If you run either, patching alone is not enough. You also need to show you checked for a compromise that may have happened before the fix.

What did CISA add to the KEV catalog for Collabora and Arista?

CISA added two critical flaws to its Known Exploited Vulnerabilities catalog on Friday, October 23, 2026, citing reports of active exploitation. The Hacker News, in a piece by Ravie Lakshmanan, reported the additions early the following morning.

• CVE-2026-110447 (CVSS 9.2), an operating system command injection in Collabora Online’s Built-in CODE Server for Nextcloud.
• CVE-2026-114625 (CVSS 9.9), an SQL injection in on-premise Arista VeloCloud Orchestrator (VCO).

Under Binding Operational Directive 22-01, US Federal Civilian Executive Branch agencies must remediate both by October 26. That is three calendar days, and two of them fall on a weekend. The directive binds US Federal Civilian Executive Branch agencies, not a payments firm in Nicosia or a ship manager in Limassol.

A KEV listing does not tell you how many organizations were breached, and it does not mean every exposed instance was hit. It means CISA has seen enough real-world use to make the flaw a top remediation priority.

Both scores sit in the CVSS Critical band of 9.0 to 10.0. The 0.7-point gap between them should not set your order of work. Exposure should drive it: which system can be reached, by whom, and with what account.

How does the Collabora CODE flaw lead to code execution on Nextcloud?

CVE-2026-110447 lets an attacker run operating system commands on the Nextcloud host through the app’s proxy.php component.

Which app is affected. The vulnerable component is Collabora Online – Built-in CODE Server, packaged as the Nextcloud app richdocumentscode. It bundles a document-editing server inside Nextcloud, so smaller installs can edit Office files in the browser without running a separate Collabora server.

When the path opens. The flaw applies when the local CODE document server is not running. A stopped or crashed helper service is easy to miss on a file server nobody watches closely.

The fix. Collabora fixed the bug in September 2026 in version 26.4.303, weeks before the KEV listing.

What attackers did next. The Hacker News has reported attackers using the flaw to plant a web shell on Nextcloud servers. They then carried out reconnaissance and searched for:

• credential stores
• password-manager artifacts
• cryptocurrency wallets

That target list tells you the goal. The file server is a stepping stone toward secrets that unlock everything else.

Why Cyprus firms should care. Self-hosted Nextcloud appeals to firms that want EU data residency, including corporate service providers, law firms and fund administrators. On those servers, a web shell sits next to passports, beneficial-ownership files and client contracts. That is a GDPR notification problem within 72 hours, on top of the technical cleanup.

If your Nextcloud is reachable from the internet, and remote access is usually the point, it belongs in the scope of your web application penetration testing. Include installed apps in that scope, not just the login page.

Who can actually exploit the VeloCloud Orchestrator SQL injection?

CVE-2026-114625 can only be exploited by someone with two things: network access to the VCO web interface, and a valid authenticated session with at least the Enterprise Read Only role.

That rules out anonymous drive-by exploitation. The bar is still low.

Read-only does not limit the damage. That role controls what the user interface lets an account do. It does not control what injected SQL does once it reaches the database. The flaw description says exploitation can reach “privileged internal functionality.” In practice, the weakest account on the portal becomes the entry point to the strongest functions.

Who usually holds read-only access:

• NOC staff
• the managed service provider
• an auditor given access last year and never removed
• a monitoring integration
• a former contractor whose password was reused elsewhere

Any of those accounts, phished or leaked, is enough. A malicious insider needs nothing extra.

Fixed versions. Arista shipped fixes in October 2026 in three release trains: 5.2.3.18, 6.1.3.10 and 6.4.2.12.

What Arista has confirmed. The company says the flaw is “known to be actively exploited.” It has not named an actor, described what attackers did after escalating privileges, or said how many organizations were affected. It did publish two IP addresses linked to the activity, both geolocated to Japan. Take them from the advisory and check them against your logs.

Do not read those addresses as attribution. Geolocation shows where an address appears to sit, not who operates it.

Our SQL injection testing runs authenticated tests at every role for this reason. In management portals, injection paths often sit behind the login, where unauthenticated scans never reach.

Why is this the third exploited VeloCloud flaw since July 2026?

The VeloCloud Orchestrator has now had three vulnerabilities used by attackers in under four months:

• CVE-2026-16812 (CVSS 10.0)
• CVE-2026-93952 (CVSS 10.0)
• CVE-2026-114625 (CVSS 9.9), the latest

Attackers keep returning to a product when it pays off, and an orchestrator pays well. It is the central console that pushes configuration and policy to SD-WAN edges at every branch.

In Cyprus, that means the shipping group linking its Limassol office to crewing agents abroad, the iGaming operator with offices in three jurisdictions, or the EMI connecting its office to a data center.

Fix the pattern, not just the bug. If your VCO took weeks to receive the July patches, it will take weeks to receive this one. Check three things:

• whether both earlier fixes were actually applied
• how long each one took to deploy
• whether anyone reviewed logs from the window before those patches

The third point matters most. An October upgrade does not undo a compromise from the summer, so extend the log review in the checklist below back to July.

Open questions. No actor has been named for either campaign. Nobody has published a count of compromised Nextcloud servers, and Arista has disclosed no victims, sectors or post-exploitation behavior. Nothing public links this activity to the earlier VCO attacks, and no Cyprus victims have been reported. Assume any unpatched, exposed instance may have been probed, and let your logs answer whether it was.

What should Cyprus and EU operators verify this week?

Confirm the exact versions, check for a compromise that may predate the fix, and record both steps. Patching and compromise assessment are separate jobs. Installing the fixed release closes the hole, but it does not remove a web shell, a rogue account or a stolen session.

Nextcloud with Collabora CODE

• Check the app version, not just Nextcloud. The Nextcloud core version tells you nothing about this flaw. Open the Apps administration view, or run occ app:list as the web server user, and confirm richdocumentscode is at 26.4.303 or later.
• Remove the app if you don’t need it. If you run a separate Collabora server, uninstall richdocumentscode.
• Check the CODE service state. Find out whether the local CODE service has been stopped or failing. That is the vulnerable condition.
• Preserve logs before you upgrade. Save current and rotated web logs first. Requests to proxy.php are leads to investigate, not proof of compromise.
• Look for persistence. Check for unfamiliar PHP files under the web root and new admin accounts. If you find either, treat the host as compromised, rotate every credential stored on it or reachable from it, and start your notification assessment.

On-premise VeloCloud Orchestrator

• Confirm your release train. Make sure you are on 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later. The advisory covers on-premise deployments; if your orchestrator is hosted, get written confirmation of its status from Arista.
• Review portal accounts. List every account at Enterprise Read Only or above. Disable stale ones, and require SSO with MFA where your deployment supports it.
• Restrict access to the UI. Limit the web interface to a management VPN or jump host. This reduces exposure but does not replace the fix.
• Check logs against the advisory. Review authentication logs and active sessions, and compare source addresses with the indicators in Arista’s advisory.

One pattern from our external network penetration testing: SD-WAN and firewall management portals often sit on public IPs because someone opened access for an MSP years ago. Your asset register will not show that; a scan of your own address ranges will.

How do NIS2 and DORA firms show a regulator they handled this?

Show a dated trail from advisory to fix to compromise check. The October 26 date does not apply to you, but supervisors under NIS2 and DORA expect vulnerability handling that is timely and documented.

NIS2 makes vulnerability handling part of mandatory risk-management measures. DORA’s ICT risk framework expects defined patching processes. Neither says “three days for KEV items.” Both expect you to explain the timeline you chose.

What the evidence trail should include:

• An asset inventory that records app-level versions, such as richdocumentscode, and not just the platform.
• The date you learned of each flaw.
• The risk decision and who made it.
• The patch date for each instance.
• The result of the log and file review.

A firm that patched the Collabora flaw in September and can prove it is in a strong position. A firm that patched on October 25 with no compromise check is not.

The decision for management. Approve a written internal deadline for flaws that are both internet-reachable and known to be exploited, and fund the out-of-hours work it needs. Measure it from the vendor fix, not the KEV date. By that measure, the Collabora fix has been available since September.

Why the cost justifies it. A web shell on a client file server can trigger a NIS2 early warning within 24 hours, a GDPR notification within 72 hours and, for financial entities, DORA incident reporting.

Scanning versus testing. A version scanner will flag an old richdocumentscode. It will not tell you that a read-only VCO account can reach admin functions; that takes testing. We explain the difference in penetration testing vs vulnerability scanning.

FAQ

Was CVE-2026-110447 fixed before CISA listed it?

Yes. Collabora fixed it in September 2026 in Built-in CODE Server version 26.4.303, weeks before the October 23 KEV listing.

Does CVE-2026-114625 need a login?

Yes. An attacker needs network access to the VCO web interface and a valid session with at least the Enterprise Read Only role. Despite that low role, the SQL injection can reach privileged internal functionality.

Does CVE-2026-114625 affect cloud-hosted VeloCloud?

The advisory covers on-premise VeloCloud Orchestrator deployments. If your orchestrator is hosted, get written confirmation of its patch status from Arista.

What did attackers do after compromising Nextcloud via the Collabora flaw?

According to The Hacker News, they installed a web shell and then carried out reconnaissance, searching for credential stores, password-manager artifacts and cryptocurrency wallets.

Is the October 26 KEV deadline legally binding for Cyprus companies?

No. It applies to US Federal Civilian Executive Branch agencies under BOD 22-01. NIS2 and DORA still expect timely, documented remediation of exploited flaws, so treat the date as a benchmark.

Where do CVE-2026-16812 and CVE-2026-93952 fit?

They are two earlier VeloCloud Orchestrator flaws, both CVSS 10.0, exploited since July 2026. CVE-2026-114625 is the third in that window.

Not sure which of your management portals and file servers are reachable from the internet? Our external network penetration testing maps them and gives you the evidence NIS2 and DORA supervisors ask for.