Collabora Online and VeloCloud flaws face active attacks
Collabora Online and Arista VeloCloud Orchestrator flaws are being exploited in active attacks, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The agency added both critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, a list of security weaknesses that have been used in real attacks. The affected systems include a document server deployed with Nextcloud and on-premise network management software.
The Collabora issue, CVE-2026-110447, has a Common Vulnerability Scoring System (CVSS) rating of 9.2. CVSS is a standard method for expressing the severity of a security flaw. The operating system command injection vulnerability affects Collabora Online Built-in CODE Server, also known as richdocumentscode, when it is used within the NextCloud platform. Command injection means an attacker can make the underlying system run instructions that the application was not supposed to accept.
The vulnerable path involves proxy.php when the CODE local document server is not running. Exploitation can result in remote code execution, meaning an attacker can make the server run software or commands over a network. The flaw was fixed in September 2026 with version 26.4.303. Website owners and hosting teams using this Nextcloud configuration should establish which version is installed rather than assuming that an application or operating system update also updated the Collabora component.
Attackers have already used CVE-2026-110447 to place a web shell on Nextcloud servers, according to reporting by The Hacker News. A web shell is a malicious file or program that gives an attacker a way to control a compromised website or server through the web. The observed activity included reconnaissance, or examining the system to learn what it contains, and searches for credential stores, password manager artifacts and cryptocurrency wallets. That makes the issue relevant beyond the document service itself because information kept on the same compromised server may also be exposed to an attacker.
The second vulnerability, CVE-2026-114625, is an SQL injection flaw in on-premise versions of Arista VeloCloud Orchestrator (VCO). SQL injection allows specially crafted input to interfere with requests sent to a database. The vulnerability has a CVSS rating of 9.9 and can let a remote attacker reach privileged internal functionality. It was fixed in October 2026 in versions 5.2.3.18, 6.1.3.10 and 6.4.2.12.
Exploiting the VCO flaw is not described as an unauthenticated internet attack. An attacker must be able to reach the VCO web interface over the network and must already have a valid authenticated session on the VCO portal. The minimum account level needed is Enterprise Read Only. Arista has acknowledged that the flaw is actively exploited, but it has not attributed the attacks to a particular threat actor or disclosed technical details about the exploitation method, the actions taken after privilege escalation or the number of affected organizations.
Arista shared two addresses associated with the activity, 74.82.197[.]86 and 38.54.50[.]151, both geolocated to Japan. Geolocation identifies where an internet address appears to be located and does not by itself establish where an attacker is physically based. CVE-2026-114625 is the third vulnerability in the product reported as weaponized in the wild since July 2026. The earlier vulnerabilities were CVE-2026-16812 and CVE-2026-93952, and both received CVSS scores of 10.0.
CISA recommended that U.S. Federal Civilian Executive Branch agencies apply the available fixes by October 26, 2026. Other organizations operating the affected products can use the same information to prioritize their own updates, particularly where a Nextcloud server contains sensitive files or a VCO portal is reachable by lower-privileged authenticated users. For readers assessing broader support needs around incidents like this, AEU-I offers security-first IT, infrastructure and consulting.
Administrators should treat an update as only one part of the response where exploitation may already have occurred. For the Collabora vulnerability, the reported installation of web shells and searches for sensitive material means affected organizations should investigate whether their servers were accessed before they were patched. For VCO, teams should identify which users can reach the portal, verify the installed release and review authenticated access because exploitation requires both network access and a valid session.