The United States Cybersecurity and Infrastructure Security Agency (CISA) has recently identified two critical vulnerabilities affecting Collabora Online’s Built-in CODE Server and Arista VeloCloud Orchestrator (VCO). These flaws have been actively exploited, prompting CISA to add them to its Known Exploited Vulnerabilities (KEV) list.
Details of the Identified Vulnerabilities
The first vulnerability, CVE-2026-110447, holds a CVSS score of 9.2 and is an operating system command injection issue within Collabora Online’s Built-in CODE Server. When integrated with the NextCloud platform, it allows remote code execution through the “proxy.php” file if the local document server is inactive. This vulnerability was addressed in the September 2026 update, version 26.4.303.
The second flaw, CVE-2026-114625, has a CVSS score of 9.9 and involves an SQL injection vulnerability in on-premise Arista VeloCloud Orchestrator versions. It enables remote attackers to gain access to sensitive internal functions. Arista released fixes in October 2026 for versions 5.2.3.18, 6.1.3.10, and 6.4.2.12.
Exploitation and Threat Actor Activities
According to reports, CVE-2026-110447 has been used by threat actors to install web shells on NextCloud servers, facilitating reconnaissance and searches for credential stores, password artifacts, and cryptocurrency wallets. Meanwhile, exploiting CVE-2026-114625 requires network access to the VCO web interface and a valid session, with the minimum required role being Enterprise Read Only.
Although Arista acknowledges the active exploitation of CVE-2026-114625, it has not identified the perpetrators or detailed the specific exploitation techniques. However, they have tracked suspicious activity to two IP addresses located in Japan.
Response and Recommendations
CVE-2026-114625 marks the third such vulnerability in Arista VeloCloud Orchestrator exploited since mid-2026, following two others with maximum severity scores. As a response to these security threats, Federal Civilian Executive Branch (FCEB) agencies are advised to implement the necessary patches by October 26, 2026, to safeguard their networks.
These developments underscore the ongoing cybersecurity challenges and the importance of staying vigilant and updated with the latest security patches to protect sensitive data from unauthorized access.
