CISA Adds Exploited Flaws in Collabora Online and VeloCloud

TL;DR - CISA added CVE-2026-110447 and CVE-2026-114625 to its Known Exploited Vulnerabilities Catalog on October 23, 2026. - CVE-2026-110447 affects Collabora Online’s Built-in CODE Server when used within the NextCloud platform. - CVE-2026-114625 affects on-prem Arista VeloCloud Orchestrator. - CISA says both additions are based on evidence of active exploitation. - CISA lists October 26, 2026 as the due date for both entries.

What happened#

CISA added two vulnerabilities to its Known Exploited Vulnerabilities, or KEV, Catalog on October 23, 2026. CISA said the additions were based on evidence of active exploitation.

The first is CVE-2026-110447, described as an OS command injection vulnerability in Collabora Online, Built-in CODE Server. CISA’s catalog says the issue occurs when Collabora Online is used within the NextCloud platform and the CODE server is not running. It describes the impact as allowing remote code execution. The catalog lists CWE-78, says ransomware use is unknown, and marks forensic triage as required. The listed due date is October 26, 2026. (CISA KEV Catalog)

The second is CVE-2026-114625, an SQL injection vulnerability in Arista VeloCloud Orchestrator on-prem. CISA says the flaw may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by it. The catalog lists CWE-89, says ransomware use is unknown, and marks forensic triage as required. Its due date is also October 26, 2026. (CISA KEV Catalog)

CISA encourages all organizations to use risk-based vulnerability management and prioritize KEV Catalog vulnerabilities. CISA’s Binding Operational Directive 26-04 applies to Federal Civilian Executive Branch agencies, not to all organizations. (CISA, Collabora Online alert; CISA, VeloCloud alert)

Are you affected#

Organizations may be affected if they operate Collabora Online’s Built-in CODE Server within the NextCloud platform, particularly where the CODE server is not running. CISA’s catalog identifies this deployment condition, but the material provided here does not publish a complete affected-version list from Collabora.

Organizations may also be affected if they operate Arista VeloCloud Orchestrator on-prem. The CISA catalog identifies the on-prem product, but it does not publish affected or fixed versions.

The Hacker News reports that CVE-2026-110447 was fixed in September 2026 in version 26.4.303. It also reports that CVE-2026-114625 was fixed in October 2026 in versions 5.2.3.18, 6.1.3.10, and 6.4.2.12. These version details are reported by The Hacker News, rather than stated in the CISA alert or catalog entry provided here. (The Hacker News)

For VeloCloud, The Hacker News reports that exploitation requires network access to the VCO web interface and a valid authenticated session on the VCO portal. It reports that the minimum required user role is Enterprise Read Only. These conditions have not been stated in the CISA material provided here. (The Hacker News)

What is confirmed and what is reported#

What defenders should do now#

1. Identify affected deployments. Check whether the organization operates Collabora Online’s Built-in CODE Server within NextCloud, and whether it operates Arista VeloCloud Orchestrator on-prem.

2. Review the CISA catalog entries and vendor guidance. CISA instructs organizations to apply mitigations in accordance with vendor instructions. The catalog links to Collabora-related guidance and Arista’s security advisory for the VeloCloud issue. (CISA KEV Catalog)

3. Prioritize remediation. CISA encourages all organizations to prioritize KEV Catalog vulnerabilities through risk-based vulnerability management. FCEB agencies have the October 26, 2026 due date listed in the catalog. (CISA)

4. Assess internet exposure. CISA says stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to applicable patching guidance. Include exposed Collabora and VeloCloud interfaces in that review. (CISA KEV Catalog)

5. Review for possible compromise. CISA’s catalog marks forensic triage as required for both entries. Organizations should follow applicable forensic triage guidance and review relevant systems for signs of compromise before remediation where required. (CISA KEV Catalog)

6. If mitigation is unavailable, follow CISA’s stated contingency. The catalog says organizations should follow applicable guidance for cloud services or discontinue use of the product if mitigations are unavailable. (CISA KEV Catalog)

This advisory is informational and is updated as vendors publish details. Confirm versions and actions against the vendor’s own guidance for your environment.

Sources

• Primary notice: cisa.gov
• Primary notice: cisa.gov
• Primary notice: cisa.gov
• Report: thehackernews.com