CISA: Collabora and VeloCloud Flaws Hit KEV

CISA added two more confirmed exploited flaws to its Known Exploited Vulnerabilities catalog on October 23: a command injection in Collabora Online’s Built-in CODE Server (CVE-2026-110447) and a SQL injection in Arista VeloCloud Orchestrator (CVE-2026-114625). Federal civilian agencies must remediate both by October 26 under Binding Operational Directive 22-01. Three days.

Collabora Online: credential theft confirmed

CVE-2026-110447 is a CVSS 9.2 command injection in the Built-in CODE Server that ships as the richdocumentscode Nextcloud app. Versions before 26.4.303 are affected. The exploit path runs through proxy.php, accessible when the local document server is not running.

CISA’s KEV entry documents what exploitation looks like in practice: attackers plant a webshell, then use it to search hosted file stores for cryptocurrency wallet data, password manager exports, and credential files. We covered this flaw when it was disclosed in October; the KEV addition confirms the targeting pattern has continued.

The patch has been out since September 2026. Update richdocumentscode to version 26.4.303 or later through the Nextcloud app store. If immediate patching is not possible, disabling the Built-in CODE Server and switching to an external Collabora Online Server instance removes the attack surface.

VeloCloud: the third strike in four months

CVE-2026-114625 is a CVSS 9.9 SQL injection in the on-premises Arista VeloCloud Orchestrator. An authenticated user with the minimum Enterprise Read Only role can access privileged internal functionality and gain operator control of the underlying VCO host. Patches are available in versions 5.2.3.18, 6.1.3.10, and 6.4.2.12.

This is the third weaponized VeloCloud flaw since July. CVE-2026-16812 hit KEV in July. CVE-2026-93952 followed in September. Now this one. Organizations running on-premises VeloCloud have watched three separate CVEs cycle from disclosure to active exploitation in roughly four months. At some point that stops being a patch management problem and starts being a product risk calculation.

Yesterday’s coverage has the full technical breakdown: Arista VeloCloud Zero-Day CVE-2026-114625 Exploited.

For the rest of us

BOD 22-01 binds federal civilian agencies. The three-day deadline is theirs to manage. But a KEV listing is CISA’s public statement that exploitation is confirmed against real targets, and neither of these products are used exclusively in government environments.

If you run Nextcloud with the Collabora Built-in CODE Server, or on-premises VeloCloud Orchestrator, treat October 26 as your own deadline.

Related: Arista VeloCloud Zero-Day CVE-2026-114625 Exploited / CVE-2026-110447: Collabora CODE Server Exploited / CISA Adds Plex2Shell, Siemens, SiteGuard to KEV / Arista VeloCloud CVSS 10.0 Flaw Added to CISA KEV