CISA warns of active exploits in Collabora Online and Arista VeloCloud

CISA announced on Friday that two critical flaws, one in Collabora Online’s built‑in CODE server and another in Arista’s VeloCloud Orchestrator, are being exploited in the wild. The agency placed both issues on its Known Exploited Vulnerabilities list and urged federal agencies to patch by October 26. The same guidance applies to any organization that runs the affected software.

Details of the two flaws

According to The Hacker News, the first vulnerability, identified as CVE‑2026‑110447, is a command‑injection bug in the Collabora Online CODE server component (also called richdocumentscode). When Collabora is deployed inside Nextcloud and the local CODE document server is not running, an attacker can send a crafted request to the proxy.php endpoint. The flaw scores 9.2 on the CVSS scale and can lead to remote code execution on the host system. The vendor released a fix in September 2026 in version 26.4.303.

The second flaw, CVE‑2026‑114625, is an SQL‑injection issue in on‑premise versions of Arista VeloCloud Orchestrator (VCO). With a score of 9.9, the bug allows a remote attacker who already has a valid, authenticated session on the VCO portal to run arbitrary SQL commands and reach privileged internal functions. Arista shipped patches in October 2026 for versions 5.2.3.18, 6.1.3.10, and 6.4.2.12.

Who is at risk

Any organization that uses Collabora Online as part of a Nextcloud deployment is potentially exposed, especially if the CODE server is disabled or misconfigured. Small businesses, nonprofits, and public‑sector teams that rely on Nextcloud for file sharing should check their installation details.

The VeloCloud flaw affects customers that run the on‑premise Orchestrator software. Enterprises that manage SD‑WAN connections with VCO, as well as government agencies that have adopted the product, need to verify they are not on a vulnerable version. CISA’s advisory specifically mentions Federal Civilian Executive Branch agencies, but the risk extends to any private network using the same software.

How the attacks are carried out

Threat actors have been observed exploiting CVE‑2026‑110447 to plant a web shell on compromised Nextcloud servers. Once the shell is in place, they conduct reconnaissance, searching for credential stores, password‑manager files, and cryptocurrency wallets. The reports note that the attackers target the server when the CODE component is not active, which widens the attack surface.

For the VeloCloud vulnerability, exploitation requires network access to the VCO web interface and a valid login session. The minimum role needed is "Enterprise Read Only," meaning that even low‑privilege accounts can be leveraged if the attacker obtains the session cookie. Arista disclosed two IP addresses in Japan, 74.82.197[.]86 and 38.54.50[.]151, as sources of malicious activity, but it has not tied the attacks to a specific group.

Immediate actions you should take

• Update the software. Verify that Collabora Online is running version 26.4.303 or later, and that Arista VeloCloud Orchestrator is on one of the patched releases (5.2.3.18, 6.1.3.10, 6.4.2.12). Apply the updates as soon as possible.
• Check your configuration. For Collabora, ensure the CODE server is either properly running or disabled in a way that does not expose proxy.php. For VeloCloud, confirm that only required users have access to the portal and that the "Enterprise Read Only" role is not granted unnecessarily.
• Enforce strong authentication. Enable multi‑factor authentication for all accounts that can log into the VCO web interface. Use unique, complex passwords for Nextcloud and Collabora admin accounts.
• Limit network exposure. Restrict inbound traffic to the VCO portal to trusted IP ranges. Block the two IP addresses reported by Arista at the firewall level.
• Monitor logs closely. Look for unexpected requests to proxy.php in Nextcloud logs and for SQL errors or privilege‑escalation attempts in VCO logs.
• Run a vulnerability scan. Use an external scanner to confirm the patches are applied and no residual exposure remains. You can start with a free external scan to see how exposed your site might be.

Longer‑term hardening recommendations

Even after the patches are in place, consider these best practices to reduce the chance of similar attacks:

• Maintain an inventory of all third‑party software and track vendor security advisories.
• Schedule regular patch cycles and test updates in a staging environment before production rollout.
• Deploy network segmentation so that critical services like VCO are isolated from general user traffic.
• Use a web‑application firewall (WAF) to filter suspicious payloads targeting known endpoints such as proxy.php.
• Conduct periodic penetration testing or red‑team exercises to validate that security controls work as intended.

By acting quickly and following these steps, small businesses, nonprofits, and public‑sector teams can protect their data and keep their networks safe from the actively exploited flaws highlighted by CISA.