CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities affecting Collabora Online and Arista VeloCloud to its Known Exploited Vulnerabilities catalog, citing active exploitation in the wild.
The vulnerabilities include CVE-2026-110447 (CVSS score: 9.2), an operating system command injection flaw in Collabora Online's CODE Server when used with NextCloud, and CVE-2026-114625 (CVSS score: 9.9), an SQL injection vulnerability in Arista VeloCloud Orchestrator. Both have been patched in recent versions.
Active Exploitation Details
Threat actors have exploited CVE-2026-110447 to backdoor Nextcloud servers with a web shell, conducting reconnaissance for credentials and cryptocurrency wallets. For CVE-2026-114625, attackers require network access and an authenticated session with at least Enterprise Read Only privileges.
known to be actively exploited
Arista has shared two IP addresses geolocated to Japan (74.82.197[.]86 and 38.54.50[.]151) associated with the exploitation activity but hasn't attributed the attacks to specific actors or disclosed the number of affected organizations.
Third VeloCloud Vulnerability
CVE-2026-114625 marks the third vulnerability in Arista VeloCloud to be weaponized since July 2026, following two other critical flaws with maximum CVSS scores of 10.0. Federal agencies have been directed to apply patches by October 26, 2026.
Related
