The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on October 23 added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild: CVE-2026-110447 in Collabora Online Built-in CODE Server and CVE-2026-114625 in Arista VeloCloud Orchestrator. The Hacker News, which first reported the additions, lists the Collabora flaw at a CVSS score of 9.2 and the Arista flaw at 9.9.
For U.S. federal agencies, KEV inclusion invokes Binding Operational Directive 26-04, which requires the flaws to be remediated on a set deadline. For everyone else, the listing signals that attackers are already using both bugs and that patching should not wait.
The Collabora flaw: unauthenticated web shells on Nextcloud
CVE-2026-110447 is an operating system command injection vulnerability in the Collabora Online Built-in CODE Server, the Nextcloud “richdocumentscode” app that downloads and runs a Collabora Online Development Edition server locally. According to the NVD entry, exploitation is possible through the app’s proxy.php script when the local CODE document server is not running, and the flaw was exploited in the wild during September and October 2026.
France’s health-sector alerting service Cyberveillance eSanté published a detailed analysis on October 14. It explains that the URL of an unauthenticated GET request to proxy.php?status is folded into the CODE start command without sanitization, allowing command substitution and directory traversal. In the attack Cyberveillance observed, a single crafted GET request dropped a PHP web shell into the richdocumentscode application directory and called out to an attacker-controlled webhook; the attacker then ran commands as the web server user, including searches for cryptocurrency wallets and password managers.
Exploitation has been confirmed against version 26.4.302. Standalone Collabora Online servers are not affected; the flaw is specific to the built-in CODE server integration with Nextcloud.
Check Point’s advisory CPAI-2026-14866, published October 19, rates the issue Critical and states that remote arbitrary code execution is possible when the CODE server is not running.
The Arista flaw: privilege escalation in VeloCloud Orchestrator
CVE-2026-114625 is a SQL injection in Arista’s VeloCloud Orchestrator (VCO) that allows an authenticated user with basic privileges and access to the VCO web interface to escalate to operator or superuser privileges, gaining access to privileged internal functionality. SecurityWeek reported that the attacker can masquerade as a local “superuser operator” and compromise the VCO host, and that Arista said the issue was detected internally and is known to be actively exploited
Arista published Security Advisory 0199 on October 22, warning that successful exploitation could compromise the confidentiality, integrity and availability of the orchestrator and the data it manages. The Canadian Centre for Cyber Security confirmed in alert AV26-1080 that Arista considers the vulnerability exploited in the wild, and that CISA added it to the KEV catalog on October 23.
This is the third exploited VCO flaw in roughly four months. CVE-2026-16812, an OS command injection with a maximum CVSS score of 10.0, affected on-premises and hosted VCO and was fixed in versions 5.2.3.14, 6.1.3.4, 6.4.2.4 and 7.0.0.1, according to The Register and Arista’s Security Advisory 0144. CVE-2026-93952, an improper input validation flaw, affected VCO On-Prem through versions 5.2.3.15, 6.1.3.7, 6.4.2.7 and 7.0.0.2.
Who is affected
- Nextcloud deployments using the Collabora Online Built-in CODE Server (richdocumentscode app) before version 26.4.303. Standalone Collabora Online servers are not affected.
- VeloCloud Orchestrator On-Prem releases before 5.2.3.18, 6.1.3.10 and 6.4.2.12. Arista has already patched its hosted VCO environments.
What to do
- Update the richdocumentscode app to version 26.4.303 or later, the release Collabora shipped in September that fixes CVE-2026-110447.
- Upgrade on-premises VeloCloud Orchestrator to at least VCO 5.2.3.18, 6.1.3.10 or 6.4.2.12. If those fixes cannot be applied yet, restrict exposure of the VCO web interface and audit for privilege escalations or operator actions taken by low-privilege accounts.
For CVE-2026-110447, defenders should hunt for unexpected PHP files in the richdocumentscode application directory, suspicious GET requests to proxy.php?status containing encoded command substitution or directory traversal, and outbound connections to unknown webhooks. The attack chain described by Cyberveillance sends its first callback to an attacker-controlled webhook before the web shell is used interactively.
Neither CISA’s catalog entries nor the vendor advisories name victims or attribute the activity to specific threat groups, and as of October 24 no victim counts or sector breakdowns had been published for either flaw. It is also unclear whether exploitation of the Collabora bug is opportunistic or targeted.