KEV catalog additions reported October 24, 2026; federal remediation due October 26, 2026
CISA Adds Two Actively Exploited Flaws to the KEV Catalog: Collabora Online and Arista VeloCloud
CISA on Friday added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. CVE-2026-110447 (CVSS 9.2) is an operating system command injection flaw in Collabora Online Built-in CODE Server, the Nextcloud document editing app, reachable through proxy.php when the local CODE server is not running; it was fixed in September 2026 in version 26.4.303, and attackers have used it to backdoor Nextcloud servers with web shells and hunt for credential stores, password manager artifacts, and cryptocurrency wallets. CVE-2026-114625 (CVSS 9.9) is an SQL injection flaw in on-premise Arista VeloCloud Orchestrator that lets an attacker with network access and any authenticated session, even an Enterprise Read Only account, reach privileged internal functions; Arista fixed it in versions 5.2.3.18, 6.1.3.10, and 6.4.2.12, and it is the third VeloCloud Orchestrator flaw weaponized since July 2026. Federal civilian agencies are directed to apply the fixes by October 26, 2026.
Executives
Two products that sit in sensitive places, your document collaboration server and the orchestrator that runs your branch network, are being exploited now, and the federal patch deadline is Monday, October 26. Ask for a named owner and a completion time for both, not a status color.
CIO / CISO
Treat any Nextcloud server that ran Collabora CODE versions before 26.4.303 as potentially compromised, not just unpatched: exploitation has been reported since September, and the payload is a web shell plus credential hunting. For VeloCloud, the low privilege bar for exploitation means session and role reviews matter as much as the upgrade itself.
Engineers
Update Collabora Built-in CODE Server to 26.4.303 or later and remove any leftover shx*.php files from web roots. Upgrade on-prem VeloCloud Orchestrator to 5.2.3.18, 6.1.3.10, or 6.4.2.12 or later, review the two attacker IP addresses Arista published, and check proxy.php access logs back to September for hits while the CODE server was stopped.
Everyone (non-IT)
If your workplace uses Nextcloud to share and edit documents, this is why it may be patched on a weekend. A flaw in the editing add-on let attackers plant hidden back doors, so the update and the cleanup both matter.