CISA has added an actively exploited Arista VeloCloud vulnerability to its Known Exploited Vulnerabilities catalog after attacks on the on-premises VeloCloud Orchestrator, a centralized management tool. Separate reporting shows a Collabora Online flaw already used to plant web shells on Nextcloud servers that run the built-in CODE Server.
Key Takeaways
- CISA added exploited Arista flaw CVE-2026-114625 to the KEV catalog.
- On-prem VCO before 5.2.3.18, 6.1.3.10, and 6.4.2.12 needs the Arista patch.
- Collabora CVE-2026-110447 runs commands only while the local CODE server is down.
- Disabling richdocumentscode does not fix it; update to 26.4.303 or remove the app.
CISA Adds the Arista VeloCloud Vulnerability to the KEV Catalog
In CISA’s KEV alert, the agency said it added one vulnerability, CVE-2026-114625, an Arista VeloCloud Orchestrator SQL injection, based on evidence of active exploitation. CISA said this type of vulnerability is a frequent attack vector and poses significant risks to the federal enterprise.
Binding Operational Directive 26-04, Prioritizing Security Updates Based on Risk, requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of KEV CVEs on publicly exposed assets that grant total control after exploitation, while deferring lower-risk work. It also establishes basic expectations for when those agencies must check whether threat actors compromised a system before the patch was applied. The directive applies only to FCEB agencies. CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.
On-Premises VeloCloud Orchestrator Exposure and Patches
SecurityWeek’s report says Arista patched the critical flaw, scored CVSS 9.9. Arista’s advisory says: “VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host.”
“On an affected system, any authenticated user can gain operator privileges and masquerade as a local ‘superuser operator’ user,” the company says. Arista said, “This issue was detected by Arista and is known to be actively exploited.”
Releases before 5.2.3.18, 6.1.3.10, and 6.4.2.12 are affected. Hosted VCO is already patched. On-premises installs are not. Deployments are exposed by default, and Arista states, “There is no configuration that can prevent the exposure.” An attacker still needs the web interface and a valid session, including the lowest built-in tenant role.
SecurityWeek called this the third exploited VCO zero-day in four months, after CVE-2026-16812 in July and CVE-2026-93952 in September. Attacks came from 74.82.197.86 and 38.54.50.151.
| Detail | Arista VCO | Collabora CODE |
|---|---|---|
| CVE | CVE-2026-114625 | CVE-2026-110447 |
| Issue | SQL injection, CVSS 9.9 | Command injection in proxy.php |
| Affected builds | Before 5.2.3.18, 6.1.3.10, and 6.4.2.12 | richdocumentscode before 26.4.303 |
| Access needed | Authenticated session, lowest tenant role | Unauthenticated; local server must be down |
| Fix | Update on-prem VCO; hosted is patched | 26.4.303 or later, or remove the app |
Collabora CODE Server Flaw Used to Plant Web Shells
The Hacker News reported that attackers exploited CVE-2026-110447 in Collabora Online – Built-in CODE Server, package richdocumentscode, to plant web shells. Three administrators reported it on GitHub. The first logged attack was September 10. Collabora fixed the bug in 26.4.303 on September 11 and published the advisory on October 14.
An unauthenticated request can run a command only while the local document server is not running, such as during a restart, upgrade, or crash. Standalone Collabora Online servers are not affected. An October 3 Nextcloud forum warning said installs using only the Nextcloud Office app, richdocuments, are not affected. The store listing describes the built-in app as “for local testing and non-production use” and “for personal use or for small teams.”
Through 26.4.302, proxy.php placed the request path inside a double-quoted bash command, so $(…) ran as the web server user. Collabora said, “It is not sufficient to disable the app to avoid the problem; it must be upgraded to >= 26.4.303 or removed.” Fixed versions require Nextcloud 30 or later. Nextcloud 29 and older are end of life, and the app store still serves an affected version. Collabora’s fix for a separate command-injection flaw in the same script, CVE-2025-66208, does not prevent this one.
Access logs from two servers show proxy.php?status requests at 19:51 on September 10 and 09:56 on September 11 (UTC+2). Those requests wrote a PHP web shell and tried to send uname -a output to webhook.site. On one server, the attacker later used the shell to search for *.kdbx, wallet.dat, and keystore.json files. The first reporter said anything the web server account can read must be treated as potentially exposed. None of the reports show root access. The CVE record says the flaw was “exploited in the wild in September and October 2026.”
mmeeks wrote, “This impacts only the Development Edition, and only in this (rather rarer) Built-in CODE Server deployment mode that downloads a local appimage.”
What IT Teams Should Do Now
The Arista flaw affects on-prem VeloCloud Orchestrator, and the Collabora flaw affects Nextcloud servers running the built-in CODE Server. Federal civilian agencies should handle the new KEV entry under BOD 26-04.
- Update on-premises VCO to 5.2.3.18, 6.1.3.10, or 6.4.2.12, block 74.82.197.86 and 38.54.50.151, and review logs for unusual paths and encoded characters.
- If compromise is suspected, preserve VCO web, backend, system, and database logs before remediation where operationally feasible.
- Until the VCO fix is deployed, restrict the interface, review recent admin activity, block outbound ports, and monitor for webshells and backdoor daemons.
- Update richdocumentscode to 26.4.303 or remove it. Disabling the app does not close the flaw. On Nextcloud 29 or older, upgrade Nextcloud or remove the app.
- Delete shx*.php files under apps/richdocumentscode and review proxy.php?status logs back to September 10 for %2e%2e, $(, or ${IFS}.
Version 26.4.402, released September 24, fails to start or open documents on some setups, and some administrators returned to 26.4.303, the build named in the advisory. No newer release had appeared as of October 14.
