CISA Adds Exploited Collabora Online and VeloCloud Flaws

CVE explainers: CVE-2026-114625, CVE-2026-110447

TL;DR - Since the last update, the reported fixed versions are now available: Collabora Online 26.4.303, and VeloCloud Orchestrator 5.2.3.18, 6.1.3.10, and 6.4.2.12. - CISA added CVE-2026-110447 and CVE-2026-114625 to its Known Exploited Vulnerabilities Catalog on October 23, 2026. - CVE-2026-110447 affects Collabora Online’s Built-in CODE Server when used within the NextCloud platform and the CODE server is not running. - CVE-2026-114625 affects on-prem Arista VeloCloud Orchestrator. - CISA says both additions are based on evidence of active exploitation. Its listed due date for both entries was October 26, 2026.

What happened#

CISA added two vulnerabilities to its Known Exploited Vulnerabilities, or KEV, Catalog on October 23, 2026, based on evidence of active exploitation. CISA encourages all organizations to use risk-based vulnerability management and prioritize vulnerabilities in the catalog. (CISA, Collabora Online alert; CISA, VeloCloud alert)

The first entry is CVE-2026-110447, an OS command injection vulnerability in Collabora Online, Built-in CODE Server. CISA says the vulnerability affects Collabora Online when it is used within the NextCloud platform and the CODE server is not running. The catalog describes the impact as remote code execution and identifies CWE-78. It says ransomware use is unknown and that forensic triage is required. The listed due date was October 26, 2026. (CISA KEV Catalog)

The second entry is CVE-2026-114625, an SQL injection vulnerability in Arista VeloCloud Orchestrator on-prem. CISA says exploitation may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by it. The catalog identifies CWE-89, says ransomware use is unknown, and requires forensic triage. The listed due date was October 26, 2026. (CISA KEV Catalog)

The Hacker News reports that CVE-2026-110447 was fixed in September 2026 in version 26.4.303. It reports that CVE-2026-114625 was fixed in October 2026 in versions 5.2.3.18, 6.1.3.10, and 6.4.2.12. (The Hacker News)

CISA’s Binding Operational Directive 26-04 applies only to Federal Civilian Executive Branch agencies. CISA encourages other organizations to prioritize KEV entries through risk-based vulnerability management. (CISA, Collabora Online alert)

Are you affected#

Organizations may be affected if they operate Collabora Online’s Built-in CODE Server within the NextCloud platform, particularly when the CODE server is not running. CISA’s catalog does not provide a complete affected-version list, but it links to Collabora’s security advisory and a NextCloud discussion. (CISA KEV Catalog)

The Hacker News reports that the Collabora issue could allow remote code execution through proxy.php when the local CODE document server is not running. It also reports that the issue was fixed in version 26.4.303. (The Hacker News)

Organizations may also be affected if they operate Arista VeloCloud Orchestrator on-prem. The Hacker News reports fixes in versions 5.2.3.18, 6.1.3.10, and 6.4.2.12. CISA’s catalog links to Arista security advisory 0199. (CISA KEV Catalog)

The Hacker News reports that exploitation of CVE-2026-114625 requires network access to the VCO web interface and a valid authenticated session on the VCO portal. It reports that the minimum required user role is Enterprise Read Only. These access conditions are not stated in CISA’s alert or catalog entry. (The Hacker News)

What is confirmed and what is reported#

What defenders should do now#

1. Inventory affected deployments. Check whether the organization operates Collabora Online’s Built-in CODE Server within NextCloud, with particular attention to deployments where the CODE server is not running. Also identify on-prem Arista VeloCloud Orchestrator instances.

2. Compare installed versions with the reported fixes. The Hacker News reports that Collabora fixed CVE-2026-110447 in version 26.4.303. It reports that VeloCloud Orchestrator fixes are available in 5.2.3.18, 6.1.3.10, and 6.4.2.12. Confirm applicable versions and upgrade instructions against vendor guidance. (The Hacker News)

3. Review CISA’s linked guidance. CISA’s catalog links to Collabora-related guidance, a NextCloud discussion, and Arista security advisory 0199. Use those materials to determine the appropriate mitigation or update for each deployment. (CISA KEV Catalog)

4. Prioritize remediation. CISA encourages all organizations to prioritize KEV vulnerabilities through risk-based vulnerability management. FCEB agencies had the October 26, 2026 due date listed for both entries. (CISA, Collabora Online alert)

5. Assess exposure. CISA says stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to applicable patching guidance. Include exposed Collabora, NextCloud, and VeloCloud interfaces in that review. (CISA KEV Catalog)

6. Review for possible compromise. CISA marks forensic triage as required for both entries. Review relevant systems for signs of compromise in accordance with applicable forensic triage guidance, especially before or during remediation where required. (CISA KEV Catalog)

7. If mitigation is unavailable, follow CISA’s contingency guidance. The catalog says to follow applicable guidance for cloud services or discontinue use of the product if mitigations are unavailable. (CISA KEV Catalog)

This advisory is informational and is updated as vendors publish details. Confirm versions and actions against vendor guidance for your environment.

This advisory is informational and is updated as vendors publish details. Confirm versions and actions against the vendor’s own guidance for your environment.

Sources

• Primary notice: cisa.gov
• Primary notice: cisa.gov
• Primary notice: cisa.gov
• Report: thehackernews.com