Two critical vulnerabilities in widely used enterprise platforms are being exploited, and both have been added to the Known Exploited Vulnerabilities catalog of the Cybersecurity and Infrastructure Security Agency (CISA). Organizations running Arista VeloCloud Orchestrator on-premises or the Collabora Online Built-in CODE Server app for Nextcloud should treat this as an urgent incident response and patching priority.
Arista VeloCloud Orchestrator: Third Exploited Zero-Day in Four Months
Arista Networks disclosed the active exploitation of CVE-2026-114625, a critical SQL injection vulnerability in the VeloCloud Orchestrator. The Orchestrator is the central management system for VeloCloud SD-WAN networks. This vulnerability has a CVSS score of 9.9 and enables an authenticated attacker, even one with the least privileged “Enterprise Read Only” role, to escalate to operator privileges and impersonate a local superuser.
This attack requires access to the VCO web interface and valid login credentials. However, VCO is exposed by default and no configuration setting prevents this exposure. Successful exploitation can compromise the orchestrator, its host, and the data it manages. This includes compromising the confidentiality, integrity, and availability of the managed network infrastructure.
What makes this especially concerning is the cadence. CVE-2026-114625 is the third exploited CVE zero-day in four months, following CVE-2026-16812 in July and CVE-2026-93952 in September. Both of these required no authentication. Organizations that patched the earlier flaws in July or September are still exposed because releases that fixed those flaws are vulnerable to this new one.
Arista has patched the Hosted and Dedicated Orchestrators. On-premises fixes are available in VCO versions 5.2.3.18, 6.1.3.10, and 6.4.2.12. Later releases are also reported to include remediation. Two IP addresses associated with the exploitation, 74.82.197.86 and 38.54.50.151, should be blocked. It is important to note that upgrading does not guarantee the removal of an attacker’s existing foothold. Defenders should preserve evidence and investigate for pre-existing access before remediation.
Collabora Online for Nextcloud: Unauthenticated RCE and Web Shell Deployment
The second actively exploited flaw is CVE-2026-110447, an operating system command injection vulnerability in the Built-in CODE Server of Collabora Online, a rich document code app for Nextcloud. With a CVSS score of 9.2, it enables remote code execution without authentication when the local CODE server is not running, such as after a restart or when the service is unavailable.
The vulnerability lies in proxy.php. When the CODE server process is down, the application fails to properly sanitize input before passing it to system commands. This enables shell expansion and arbitrary command execution. These commands run with the web server account’s privileges. Disabling the application through Nextcloud does not prevent exploitation because the vulnerable handler remains directly executable by the web server. Standalone Collabora Online servers are not affected; only Nextcloud’s embedded CODE Server deployment is vulnerable.
Attacks observed have gone beyond initial access. Threat actors have deployed PHP web shells on compromised Nextcloud servers and used them to conduct reconnaissance and search for credential stores, password managers, and cryptocurrency wallets. At least three administrator accounts have reported similar compromises. Investigators found no evidence of root access in these cases, but the web server-level access obtained is sufficient to read or modify application data, steal credentials and secrets, and disrupt services.
The fix is available in Rich Documents Code version 26.4.303 and later. Fixed versions require Nextcloud 30 or later. Installations on Nextcloud 29 or earlier must be upgraded to a compatible, supported release, or the app must be removed entirely. On October 23, CISA added the flaw to its KEV catalog, requiring federal civilian agencies to remediate by October 26, 2026.
What Defenders Should Do Now
Patching is necessary but not sufficient for both vulnerabilities. The window of opportunity for exploitation has been open for weeks. Collabora was exploited in September and October of 2026, and the VeloCloud flaw was exploited before its disclosure on October 22. Patching does not eliminate an existing compromise.
VeloCloud Orchestrator:
- Upgrade on-premises VCO to 5.2.3.18, 6.1.3.10, or 6.4.2.12, or later.
- Until patched, restrict VCO web interface access to trusted administrative networks, block the two known malicious IPs, and monitor for unexpected outbound activity, backdoor daemons, and web shells.
- Preserve VCO web access logs, backend application logs, system logs, database logs, and relevant file-system timestamps before remediation, and review recent administrator activity for signs of privilege escalation.
Nextcloud + Collabora Online:
- Upgrade to version 26.4.303 or later of Rich Documents Code. If updating is not feasible and the functionality is unnecessary, remove the app.
- Restrict untrusted access to the affected handler using reverse-proxy, web-server, and perimeter controls; merely disabling the app in Nextcloud is insufficient.
- Investigate previously exposed systems for web shells, unauthorized files, integrity changes, and suspicious requests dating back to at least September 10, 2026.
- Rotate exposed credentials and application secrets from a trusted environment, and revoke and replace compromised keys or certificates.
Both incidents have one thing in common: attackers are moving quickly against internet-facing enterprise infrastructure. The VeloCloud case demonstrates that a low-privilege, authenticated account can serve as an entry point for a complete compromise of operator-level access. Organizations should treat these incidents as active intrusions to hunt for rather than just vulnerabilities to patch.
