Arista VeloCloud and Collabora CVEs Join CISA KEV

Two critical flaws with little in common apart from a date were added to the CISA KEV catalog on October 23, 2026, and both carry the same federal due date of October 26. CVE-2026-114625 is a SQL injection in Arista VeloCloud Orchestrator that lets any logged-in user act as a superuser operator. CVE-2026-110447 is an unauthenticated OS command injection in the built-in CODE server app that Nextcloud admins use to run Collabora Online. Both are being exploited, and both have a fixed release you can install today.

CVE-2026-114625: SQL injection in VeloCloud Orchestrator

Arista published its advisory on October 22 for an SQL injection (CWE-89, internal bug ID BUG2043622) in on-prem VeloCloud Orchestrator, the management plane for VeloCloud SD-WAN. The reporting we read does not say which endpoint or parameter is injectable. What it does say is that any authenticated user can gain operator privileges and masquerade as a local superuser operator. The lowest built-in tenant role, Enterprise Read Only, is enough, so the attacker does not need an admin account, and no user interaction is required. The scores are 9.9 on CVSS 3.1 and 9.4 on CVSS 4.0.

Arista says it detected the issue itself and that it is known to be actively exploited. Public reporting so far names no actor and gives no victim count, start date or post-exploitation detail. The Orchestrator web interface is exposed by default, and the advisory states that no configuration prevents that exposure.

The affected on-prem releases are 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10 and 6.4.x before 6.4.2.12, and each train is fixed in those releases and later. Hosted deployments, including Dedicated, were affected and Arista has already patched them. VeloCloud Gateway and Edge are not affected. Releases past end of support were not assessed, and Arista points those customers to TAC.

This is not the first time. THN and SecurityWeek count it as the third exploited Orchestrator zero-day in about four months, after CVE-2026-16812 in July and CVE-2026-93952 in September. BleepingComputer also lists a May flaw, CVE-2026-7473, so the count depends on which outlet you read.

CVE-2026-110447: command injection in the built-in CODE server

Nextcloud's richdocumentscode app bundles a local Collabora Online Development Edition server, the built-in CODE server, and starts it from an AppImage through PHP. Collabora's GitHub advisory, published October 14, describes an unauthenticated OS command injection (CWE-78) in the app's proxy.php. A single request can make the web server run an operating system command as the web server user. The CVSS 4.0 score is 9.2.

There is a condition. The attack only works while the built-in CODE server is not running, which happens during a restart, an upgrade or after a crash. Disabling the app does not remove the risk. The advisory says it must be upgraded to 26.4.303 or later, or removed.

The affected range is richdocumentscode before 26.4.303. Standalone Collabora servers are not affected, and the Nextcloud forum thread adds Docker, Linux packages, hosted Collabora and richdocuments without richdocumentscode to the safe list. THN reports that the fixed versions need Nextcloud 30 or later, so instances on end-of-life Nextcloud 29 or older should upgrade Nextcloud or remove the app. The advisory also states this is a different path from CVE-2025-66208, and the fix for that one does not stop this one.

Exploitation started in September. A hosting provider reported on GitHub that its first logged attack came on September 10 and a second on September 11, both from 139.28.18.122 and both aimed at /apps/richdocumentscode/proxy.php?status with a command substitution payload in the path. Another attempt on September 14 came from 89.38.98.50 against a server already on 26.4.303 with the app still enabled. Forum users have reported finding webshells. On the one server analysed in detail, the attacker left a one-line PHP webshell that calls back to webhook.site, then searched for password manager databases and wallet files such as .kdbx, wallet.dat and keystore.json. The reviewed requests showed no archive, upload or exfiltration commands, but the reporter advises treating anything the web server account can read as exposed. No actor or victim count has been published.

Same day, same deadline, different reach

Both CVEs score above 9, both entered KEV on the same day and both share the October 26 due date, so they look like a pair. They are not. The Arista flaw needs a login, but the lowest tenant role is enough, and SSVC marks it Not automatable. The Collabora flaw needs no login at all, SSVC marks it Automatable, and EPSS is 1.2% against 0.6% for the Arista one. On the other side, the Collabora attack only lands while the built-in CODE server is down and only on Nextcloud instances that use that built-in mode.

So the useful question is who can reach the bug. If you run VeloCloud Orchestrator on-prem, anyone holding any tenant account is a potential operator. If you run Nextcloud with the built-in CODE server, anyone who can reach the instance from the internet is a potential attacker during a restart window. Both EPSS values are low, which is common for freshly disclosed flaws. KEV membership already tells you exploitation is happening.

Reading it on VulnTracker

CVE-2026-114625 shows 9.9 Critical, EPSS 0.6%, KEV added October 23 with a due date of October 26, and SSVC Active exploitation, Not automatable, Total technical impact. The weakness is CWE-89 and the status is Published. CVE-2026-110447 shows 9.2 Critical, EPSS 1.2%, the same KEV dates, SSVC Active, Automatable, Total, CWE-78, and the status Deferred, which means there is no NVD analysis to lean on.

Two gaps to know about. The affected entries on the Arista record list 5.2.0, 6.1.0 and 6.4.0 at 80% confidence. Those are train starting points and do not match the vendor ranges, which are before 5.2.3.18, 6.1.3.10 and 6.4.2.12, so use the vendor ranges. The Collabora record's affected platform entry shows only "0" at 90% confidence, so go by the GitHub advisory: richdocumentscode before 26.4.303. The remediation guide is empty on both for now, which is why the next section spells out the steps.

What to do before October 26

For VeloCloud Orchestrator on-prem, upgrade to 5.2.3.18, 6.1.3.10, 6.4.2.12 or a later release in your train. If you are on an unsupported train, contact Arista TAC. Until you can patch, restrict the web interface to trusted admin networks, keeping in mind that Arista treats this as temporary and not a fix. Block 74.82.197.86 and 38.54.50.151 and search the web access logs for unusual URL-like path components, encoded characters, references to local or internal services and high request rates. Where operationally feasible, preserve the web access, backend application, system and database logs and file timestamps before you patch. After patching, check for unexpected outbound connections, backdoor daemons and webshells, and review recent admin changes.

For Nextcloud with the built-in CODE server, update richdocumentscode to 26.4.303 or later, or remove the app. Disabling it is not enough. On Nextcloud 29 or older, upgrade Nextcloud or remove the app. Then hunt, going back to at least September 10:

Run the Nextcloud integrity check and look for EXTRA_FILE entries under richdocumentscode. Known dropped files include shrf4645.php, shxa35d0.php, shx5cf91.php, shxd33ce.php, shxf4645.php, shx56367.php, shx13a86.php and Nx_33143.php. One reported SHA-256 is 4b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562.
Search access logs for proxy.php?status requests containing %2e%2e, $( or ${IFS}, and for repeated ?c= requests to shx*.php files.
Look for coolwsd or Collabora_Online.AppImage processes whose command line has a remote_font_config.url value containing $(, and for sudo failures by the web server account.
Check outbound traffic to webhook.site.

If you find anything, delete the leftover files and rotate every secret the web server account can read.

Takeaway

Treat these as two separate jobs with one deadline. The Arista fix is a planned upgrade of a management plane that every tenant user can reach. The Collabora fix is a small app update that an unauthenticated visitor can exploit during any restart window, and it comes with files to hunt for. If the Nextcloud side applies to you, patching alone does not close the story, because attacks began in September and a leftover webshell survives the update.

To follow how both records fill in, including the affected-version data and remediation guides, open them on VulnTracker.