CISA Adds Collabora and Arista VeloCloud Flaws to Known Exploited List

The U.S. Cybersecurity and Infrastructure Security Agency added two critical software flaws to its Known Exploited Vulnerabilities catalog on Friday, citing confirmed attacks already under way. One vulnerability affects Collabora Online, a document tool used on self-hosted Nextcloud servers. The other hits Arista VeloCloud Orchestrator, a platform enterprises use to manage large corporate networks.

CISA's KEV catalog tracks flaws with real-world attacks behind them. A listing triggers a patching deadline for civilian federal agencies. It also serves as a firm signal to private organizations: these threats are active, not theoretical. Both flaws carry near-maximum severity scores, and both are already in use by attackers.

CISA flags known exploited vulnerabilities in Collabora and Arista

The Collabora flaw, tracked as CVE-2026-110447, carries a CVSS score of 9.2. The Arista VeloCloud bug, CVE-2026-114625, has a CVSS score of 9.9. CVSS is a standard scale used to measure how severe a software vulnerability is. Both scores put these flaws in the critical tier, meaning attackers could gain serious control of affected systems.

CISA published two separate alerts on the same day, one per product. In each case, the agency described this class of flaw as a frequent attack path that carries significant risk to government and private networks alike. The KEV catalog is widely watched across the security industry, and new entries regularly push organizations well outside the federal government to act fast.

How the Collabora Online flaw works

CVE-2026-110447 is an operating system command injection flaw in Collabora Online's built-in CODE Server. That component handles document rendering for organizations running Nextcloud, a widely used self-hosted file-sharing platform. In an OS command injection attack, an attacker sends crafted input that tricks the software into running system commands it was never meant to run.

The attack runs through a script called proxy.php and can allow remote code execution on vulnerable systems. It opens only when the local CODE document server is not running. Collabora released a fix in September 2026 in version 26.4.303. Systems on older versions remain exposed.

Attackers have already acted on this gap. The Hacker News reported that threat actors planted web shells - small backdoor scripts - on compromised Nextcloud servers. After getting in, they searched for credential stores, password manager files, and cryptocurrency wallet data. That target mix points to financially motivated actors trying to steal login credentials and digital assets from compromised hosts.

Nextcloud is used by organizations that prefer to run their own file-sharing infrastructure on site. Government agencies, universities, healthcare providers, and businesses that handle sensitive data all rely on it. Any deployment pairing Nextcloud with an unpatched Collabora CODE Server is a potential target, which makes this flaw broadly important beyond the tech sector.

How the Arista VeloCloud vulnerability works

CVE-2026-114625 is a SQL injection flaw in on-premise versions of Arista VeloCloud Orchestrator. VeloCloud Orchestrator is the management console enterprises and service providers use to configure and monitor software-defined wide-area networks, or SD-WAN, across many locations. In a SQL injection attack, an attacker inserts malicious database commands into a software query to reach data or functions that should be off-limits.

Exploiting this flaw requires two conditions: network access to the VeloCloud web interface and a valid, active session on the portal. The minimum role required is Enterprise Read Only, one of the lowest permission levels in the system. That access barrier provides some protection, but it is not a strong one.

Low-privilege accounts are often obtained through phishing, credential-stuffing campaigns, or data from past breaches. Once an attacker holds even a basic account, this flaw could allow access to privileged internal functions far above what that role normally permits. For a network management platform, that kind of access can expose configurations, traffic policies, and connected device inventories across an entire organization.

Arista has acknowledged the vulnerability is "known to be actively exploited" but has not named a specific threat actor or described the attack methods used. The company has also not disclosed how many organizations were affected. Patched releases - versions 5.2.3.18, 6.1.3.10, and 6.4.2.12 - arrived in October 2026.

VeloCloud has seen three exploited bugs since July 2026

CVE-2026-114625 is the third VeloCloud Orchestrator flaw to be actively used in attacks since July 2026, according to The Hacker News. The two earlier flaws, CVE-2026-16812 and CVE-2026-93952, each received a CVSS score of 10.0, the highest rating on the scale.

Three weaponized bugs in the same product over a few months shows that attackers have set their sights specifically on this platform. Network management tools are high-value targets because they offer visibility into, or control over, large segments of a company's or agency's infrastructure. A compromised orchestrator can become a launchpad for far wider access into a network.

For organizations running VeloCloud, this pattern means the window for inaction is closed. Scheduling this patch for a future maintenance cycle is not a sound response when three separate vulnerabilities in the product have already been used in the wild.

The federal deadline and what it means for everyone

CISA set an October 26, 2026 deadline for Federal Civilian Executive Branch agencies to deploy both patches. That deadline flows from BOD 26-04, which sets vulnerability management rules for those agencies. The directive calls for rapid patching of KEV catalog flaws on public-facing systems that could give an attacker full control of a device. It also requires agencies to check whether attackers got in before a patch was applied.

The directive covers only civilian federal agencies, not private companies. But CISA encourages all organizations to treat KEV entries as high-priority fixes. Every flaw on the list has confirmed, active exploitation behind it. These are not routine software updates.

The requirement to check for prior compromise is just as relevant for private sector teams. Both flaws were being exploited before CISA added them to the catalog. Patching stops new intrusions but does not remove access an attacker already established. Security teams should review logs for signs of earlier compromise while working through the updates.

Steps for affected organizations

Teams running Collabora Online with the built-in CODE Server on Nextcloud should update to version 26.4.303 or a later release immediately. After patching, check server logs for web shell activity, unusual outbound connections, and any access to credential stores or wallet files.

Organizations managing on-premise Arista VeloCloud Orchestrator should move to one of the patched releases: 5.2.3.18, 6.1.3.10, or 6.4.2.12. Audit recent portal sessions and pay close attention to low-privilege accounts that may have accessed elevated functions.

Both CISA alerts note that these types of flaws are common attack vectors carrying significant risk to networks well beyond the federal government. Both vulnerabilities are under active attack right now. Immediate patching is the appropriate response.