On October 23, 2026, CISA added two critical issues to the Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-110447 in Collabora Online Built-in CODE Server for Nextcloud (CVSS 9.2) and CVE-2026-114625 in Arista VeloCloud Orchestrator (CVSS 9.9). Both vulnerabilities are confirmed to be exploited in the wild. Administrators of Nextcloud installations with the richdocumentscode module and operators of on-premises VeloCloud Orchestrator deployments must immediately apply the available patches. According to the original source, U.S. Federal Civilian Executive Branch (FCEB) agencies are recommended to remediate these vulnerabilities by October 26, 2026.
CVE-2026-110447: OS command injection in Collabora Online CODE Server
The vulnerability CVE-2026-110447 is an operating system command injection (CWE-78) in the proxy.php component of the richdocumentscode module — the built-in CODE server for the Nextcloud platform. According to the CNA record, the vulnerability allows remote code execution when the local CODE document server is not running. The CVSS 4.0 score is 9.2 (critical severity).
Crucially, the vulnerability affects only Nextcloud deployments with the Built-in CODE Server (richdocumentscode) module, and not standalone Collabora Online servers. The fix was released in version 26.4.303, as stated in the project’s security advisory.
According to an incident report in the project repository, the same attack pattern was observed across several independent Nextcloud installations in September–October 2026: attackers installed PHP web shells, conducted reconnaissance, and specifically searched for credential stores, password manager artifacts, and cryptocurrency wallets. The exact number of affected organizations has not been established.
CVE-2026-114625: SQL injection in Arista VeloCloud Orchestrator
The vulnerability CVE-2026-114625 is an SQL injection (CWE-89) in on-premises versions of Arista VeloCloud Orchestrator (VCO). According to the Arista advisory, successful exploitation allows a remote attacker to gain access to privileged internal functionality of the orchestrator. The CVSS 3.1 score is 9.9, and the CVSS 4.0 score is 9.4 (critical severity).
Affected versions:
- VCO 5.2.x before 5.2.3.18
- VCO 6.1.x before 6.1.3.10
- VCO 6.4.x before 6.4.2.12
Arista confirms that the vulnerability is being actively exploited. A successful attack requires network access to the VCO web interface and a valid authenticated session on the portal; the minimum required role is Enterprise Read Only. Despite confirming exploitation, Arista has not disclosed attribution to any specific group, technical details of post-exploitation, or the number of affected organizations.
Differences in the threat profile
The two vulnerabilities differ significantly in their scope of impact. CVE-2026-110447 does not require authentication and targets a component exposed to the internet — proxy.php in Nextcloud. This makes it suitable for mass exploitation, which is confirmed by observations across multiple independent installations. CVE-2026-114625, by contrast, requires an authenticated session on the VCO portal, which narrows the pool of attackers but does not reduce the severity: compromising an SD-WAN orchestrator can potentially provide control over the entire managed network infrastructure.
Recurring problem in VeloCloud Orchestrator
CVE-2026-114625 is not an isolated incident. It is the third vulnerability in VeloCloud Orchestrator that is confirmed to be exploited in the wild and has been added to the CISA KEV catalog since July 2026. Previously, CVE-2026-16812 (CVSS 10.0, OS command injection, added to KEV on July 27) and CVE-2026-93952 (CVSS 10.0, improper input validation, added on September 22) were recorded. The active exploitation of both is confirmed in the corresponding Arista advisories: Security Advisory 0144 and Security Advisory 0183. We have already written about these vulnerabilities: CVE-2026-16812: critical RCE in Arista VeloCloud Orchestrator and CVE-2026-93952: CVSS 10.0 in Arista VeloCloud Orchestrator.
Such a concentration of critical exploited vulnerabilities in a single product over four months points to a systemic security problem in the platform. Organizations using VCO On-Prem should view the situation not as a series of isolated patches but as a reason to comprehensively reassess the security of their deployment.
Indicators of compromise
Arista has published IP addresses observed in attacks on CVE-2026-114625:
74.82.197[.]8638.54.50[.]151
The following indicators are available for CVE-2026-110447:
- IP:
139.28.18[.]122 - Domain:
webhook[.]site - Hash:
4b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562 - Characteristic URL patterns:
/apps/richdocumentscode/proxy.php?statusand/apps/richdocumentscode/proxy.php/apps/richdocumentscode/shx*.php
These indicators should be used for detection and retrospective log hunting, but not for geographical or group attribution of the attackers — available data is insufficient for such attribution.
Recommendations
For Collabora Online CODE Server in Nextcloud:
- Update the richdocumentscode module to version 26.4.303 or later
- Check web server logs for requests to
proxy.phpwith unusual parameters - Search for PHP files matching the
shx*.phppattern in the application directory - If signs of compromise are found, treat all credentials on the server as compromised
For Arista VeloCloud Orchestrator On-Prem:
- Update VCO to versions 5.2.3.18, 6.1.3.10, or 6.4.2.12 respectively
- Block the listed IP addresses and check logs for connections from them
- Audit authenticated sessions, especially those with the Enterprise Read Only role — the minimum required for exploitation
- Given three exploited vulnerabilities in four months, perform a full review of network segmentation and access control to the VCO web interface
Organizations with on-premises VeloCloud Orchestrator deployments need not only to apply the patch for CVE-2026-114625 but also to ensure that fixes for CVE-2026-16812 and CVE-2026-93952 have been applied as well. Three critical vulnerabilities with confirmed exploitation over a short period call for a proactive approach: restricting access to the VCO web interface to trusted networks, monitoring anomalous SQL queries, and performing retrospective log analysis for the period since July 2026.
