CISA Orders Federal Agencies to Patch Collabora and Arista Flaws by October 26

The U.S. Cybersecurity and Infrastructure Security Agency added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog on Friday, October 23, 2026, and gave federal civilian agencies until October 26 to remediate them. The entries cover CVE-2026-110447, a command injection flaw rated CVSS 9.2 in Nextcloud's Collabora Online Built-in CODE Server, and CVE-2026-114625, an SQL injection flaw rated CVSS 9.9 in on premises deployments of Arista VeloCloud Orchestrator. The deadline falls three days after the listing, and the entries follow reports of active exploitation.

The two products sit in different parts of enterprise infrastructure. Collabora's Built-in CODE Server, distributed as the richdocumentscode app for Nextcloud, provides local document editing inside private cloud installations. VeloCloud Orchestrator is the central management system for VeloCloud SD-WAN networks, where operators create customer and partner accounts and partners manage groups of customers. A flaw in either system can expose documents, credentials, or control of a network management plane. The KEV listing is CISA's public statement that exploitation is confirmed against real targets.

CISA's catalog entry follows reports of active exploitation, and the agency's Binding Operational Directive 22-01 requires federal civilian agencies to fix listed flaws within set deadlines. The October 26 deadline applies to both issues. The Hacker News reported on October 24 that CISA added both flaws to its KEV catalog on Friday and set an October 26 patch deadline for federal civilian agencies. 0dayNews reported on October 24 that federal civilian agencies must remediate both flaws by October 26 under Binding Operational Directive 22-01.

The patching picture differs by product. The Collabora issue was fixed in September 2026 in richdocumentscode version 26.4.303. Arista published fixes in October 2026 for VCO versions 5.2.3.18, 6.1.3.10 and 6.4.2.12. The VeloCloud flaw is the third vulnerability in the same product reported as exploited since July 2026, following CVE-2026-16812 and CVE-2026-93952, both rated CVSS 10.0. That pattern makes the latest KEV entry more than a routine patch notice for defenders who run the orchestrator.

Key Facts

CVE-2026-110447 is an operating system command injection flaw in Collabora Online Built-in CODE Server when used within the Nextcloud platform. The exploit path runs through proxy.php when the CODE local document server is not running, allowing remote code execution. The Hacker News reported on October 24 that the flaw was fixed in September 2026 in version 26.4.303. The CVSS score is 9.2.

Exploitation of the Collabora flaw has involved a web shell. The Hacker News previously reported that threat actors used CVE-2026-110447 to backdoor Nextcloud servers, then conducted reconnaissance and searched for credential stores, password manager artifacts and cryptocurrency wallets. 0dayNews reported on October 24 that CISA's KEV entry documents this pattern: attackers plant a webshell and use it to search hosted file stores for cryptocurrency wallet data, password manager exports and credential files.

CVE-2026-114625 is an SQL injection vulnerability in on premises versions of Arista VeloCloud Orchestrator. Arista Networks stated in Security Advisory 0199 on October 22 that a remote attacker may access privileged internal functionality and impact the VCO host. The advisory assigns a CVSSv3.1 base score of 9.9 and a CVSSv4.0 base score of 9.4. It lists CWE-89 and Arista bug ID BUG2043622.

The VeloCloud flaw requires network access to the VCO web interface and a valid authenticated session. The minimum role required is Enterprise Read Only. Arista Networks stated in Security Advisory 0199 on October 22 that any authenticated user can gain operator privileges and masquerade as a local superuser operator, including access to functionality intended for internal use only and not intended to be remotely accessible. VCO is exposed by default, and Arista says no configuration can prevent the exposure. Hosted and Dedicated versions were impacted and have already been patched.

The fixed on premises releases are VCO 5.2.3.18, 6.1.3.10 and 6.4.2.12. Affected software includes VCO 5.2.x releases prior to 5.2.3.18, VCO 6.1.x prior to 6.1.3.10 and VCO 6.4.x prior to 6.4.2.12. Arista acknowledged the vulnerability is known to be actively exploited but did not attribute the activity, provide technical details or disclose the number of affected organizations. It shared two IP addresses geolocated to Japan as responsible for the activity: 74.82.197.86 and 38.54.50.151. The Hacker News reported on October 22 that the flaw is the third in VCO since late July reported as exploited and the first of the three that requires a login.

Analysis

The most important operational fact is that both fixes were available before the KEV deadline. The Collabora patch shipped in September, and the Arista fixes arrived in October. The three day remediation window is therefore not a warning about an unknown problem. It is a test of whether agencies and other operators can locate instances, confirm versions and apply updates on short notice. For Collabora, the update path is the Nextcloud app store and richdocumentscode 26.4.303 or later. For VeloCloud, the path is one of three VCO releases.

The VeloCloud case is especially instructive because authentication does not provide a safety margin. A successful attack needs only a valid session with the Enterprise Read Only role, the lowest built-in role for customer users. That means a read only customer account is enough to reach operator privileges and act as a local superuser. The bigger picture here is that management planes remain high value targets even when an application appears to separate low privilege users from administrative functions. VCO operators create customer and partner accounts, and each partner can manage a group of customers, so control of the orchestrator can affect more than a single account.

The repeated VeloCloud exploitation also changes how defenders should read the advisory. CVE-2026-16812 and CVE-2026-93952 were both rated CVSS 10.0 and were reported as exploited in July and September. The new flaw is the third in roughly four months, and it is the first of the three that requires a login. Orchestrators running releases that fixed the July and September flaws are still affected because those releases are older than the new fixes. That detail matters for organizations that believe a recent upgrade has already closed the product's exposure.

CISA's KEV listing does not by itself prove that every exposed system has been hit, and Arista did not disclose victim counts. But KEV placement is not a generic advisory. It is a statement that exploitation has been confirmed against real targets. The short deadline converts that statement into a compliance requirement for federal civilian agencies and a clear signal for private operators. What this really means is that defenders should treat the two CVEs as active incidents to check, not as future patch tasks.

Why It Matters

Neither product is used exclusively in government environments. Nextcloud installations with the Built-in CODE Server can appear in organizations that need local document editing. VeloCloud Orchestrator manages VeloCloud SD-WAN networks, where operators create customer and partner accounts. A KEV entry for both products therefore reaches beyond federal civilian agencies. The same versions and the same exploitation paths exist in commercial deployments, even if the October 26 deadline is written for agencies.

The consequences differ by product but share a common theme. On the Collabora side, a web shell can give an attacker a foothold in a document server and a path to credential stores, password manager artifacts and cryptocurrency wallets. On the VeloCloud side, operator privileges can expose, modify or disrupt the orchestrator and the data it manages. Arista's advisory warns that a successful attack may compromise confidentiality, integrity and availability. For a management plane, that combination is more serious than a single application outage because it can affect every customer and partner group under the orchestrator.

The timing also matters. The KEV deadline falls three days after the October 23 listing. Agencies that cannot patch immediately have limited alternatives. Arista recommends restricting access to the VCO web interface to trusted administrative networks, monitoring for accesses from known malicious IPs and unexpected outbound activity, considering blocks on unnecessary outbound ports, monitoring for backdoor daemons and webshells, and reviewing recent administrator activity. For Collabora, disabling the Built-in CODE Server and switching to an external Collabora Online Server instance removes the attack surface if immediate patching is not possible.

Next Up

Federal civilian agencies must apply the fixes by October 26. Organizations outside the federal civilian branch should not wait for a mandate. They should inventory Nextcloud installations that use richdocumentscode, confirm whether the app is at version 26.4.303 or later, and check on premises VCO deployments against versions 5.2.3.18, 6.1.3.10 and 6.4.2.12. Hosted and Dedicated VCO versions have already been patched, but on premises systems require action.

Defenders should also review VCO web access logs for unusual URL like path components, encoded characters, references to local or internal services or high request rates. Arista's advisory lists 74.82.197.86 and 38.54.50.151 as observed attacking IPs. The advisory notes that end of support versions have not been assessed, so older deployments need a separate review. CISA's KEV catalog will remain the public record of the October 23 listing, and the October 26 deadline will show how quickly agencies can close two confirmed exploitation paths.