CISA Adds Two Actively Exploited Collabora Online and Arista VeloCloud Flaws to KEV
Summary
CISA added two actively exploited flaws affecting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator to its KEV catalog. Arista says exploitation is ongoing but provided no actor attribution or technical details.
Key points
- CISA added CVE-2026-110447 and CVE-2026-114625 to its Known Exploited Vulnerabilities catalog, citing reports of active exploitation.
- Threat actors have reportedly exploited CVE-2026-110447 to backdoor Nextcloud servers with a web shell and search for credential stores, password-manager artifacts, and cryptocurrency wallets.
- Exploiting CVE-2026-114625 requires network access to the VeloCloud Orchestrator web interface and a valid authenticated session; the minimum required role is Enterprise Read Only.
- Arista acknowledged active exploitation of CVE-2026-114625 but did not identify an actor, explain the exploitation or post-escalation activity, or disclose the number of affected organizations.
- CVE-2026-114625 is the third VeloCloud Orchestrator vulnerability reported weaponized since July 2026, following CVE-2026-16812 and CVE-2026-93952.
- CISA recommended that Federal Civilian Executive Branch agencies apply fixes by October 26, 2026.
Article Details
- Severity
- Critical
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
CVE-2026-110447As reported by The Hacker News, threat actors have been observed exploiting CVE-2026-110447 to backdoor Nextcloud servers with a web shell so as to conduct reconnaissance and search for credential stores, passwordCVE-2026-114625As for CVE-2026-114625, successful exploitation requires an attacker to have network access to the VCO web interface and a valid authenticated session on the VCO portal. The minimum user role required is Enterprise ReadCVE-2026-16812CVE-2026-114625 is the third vulnerability in the same product to have been weaponized in the wild since July 2026, following CVE-2026-16812 (CVSS score: 10.0) and CVE-2026-93952 (CVSS score: 10.0).CVE-2026-93952CVE-2026-114625 is the third vulnerability in the same product to have been weaponized in the wild since July 2026, following CVE-2026-16812 (CVSS score: 10.0) and CVE-2026-93952 (CVSS score: 10.0).
Vendors
Arista NetworksAgency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of activeCollaboraCybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited
Products
Arista VeloCloud Orchestratoron Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation inCollabora Online Built-in CODE Serverand Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV),NextcloudAs reported by The Hacker News, threat actors have been observed exploiting CVE-2026-110447 to backdoor Nextcloud servers with a web shell so as to conduct reconnaissance and search for credential stores, password