Two KEV Deadlines Hit Today: Arista, Collabora

Today is the CISA remediation deadline for two KEV entries that arrived last week. If you’re in a federal agency and haven’t patched, you’re overdue. If you’re running this software in any other environment, the same window applies in practice.

CVE-2026-114625: Arista VeloCloud Orchestrator (CVSS 9.9, critical)

SQL injection in Arista’s on-premises VeloCloud Orchestrator lets any authenticated user escalate to superuser operator-level access. Exploitation was confirmed October 22, the same day Arista shipped fixes. CISA added the CVE to the catalog October 23 with a three-day window.

Fixed versions: 5.2.3.18, 6.1.3.10, 6.4.2.12 and later. Cloud-hosted VCO customers are covered by Arista’s managed update. On-premises deployments need a manual upgrade; check your VCO version from the System > Administration panel.

Read the full Arista VeloCloud zero-day writeup for patch details and indicators.

CVE-2026-110447: Collabora Online Built-in CODE Server (CVSS 9.8, critical)

OS command injection in the richdocumentscode Built-in CODE Server before version 26.4.303 allows remote code execution when the CODE server isn’t running as a sidecar process. Active exploitation against Nextcloud instances was reported as early as October 15. CISA’s October 23 addition with a three-day window lines up with how quickly this moved from advisory to confirmed exploitation.

For Nextcloud users, the Nextcloud Plugin Store delivers the patched richdocumentscode version automatically for managed instances. Self-hosted deployments should verify the installed richdocumentscode version directly and force the update if it hasn’t applied.

Context: the rest of this week’s batch

CISA’s full batch from October 20-26 included four Plex Media Server CVEs (due October 23, now overdue), an EG Secure Solutions SiteGuard OS command injection (due October 23), and a Siemens Software Center DLL hijacking flaw (due November 3). The Plex chain is covered in the Plex2Shell KEV writeup.

The full catalog lives at cisa.gov/known-exploited-vulnerabilities-catalog. Tracked entries for this site are at /kev-tracker.