CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud

CISA has added two actively exploited critical flaws to its Known Exploited Vulnerabilities catalog: one in Collabora Online's Built-in CODE Server (richdocumentscode) used with NextCloud, and another in Arista VeloCloud Orchestrator (VCO). The Collabora bug, CVE-2026-110447 (CVSS 9.2), is an OS command injection via proxy.php that lets attackers achieve remote code execution when the local document server is offline, and it has already been used to plant web shells on Nextcloud servers to hunt for credentials, password manager data, and crypto wallets; it was patched in version 26.4.303. The Arista flaw, CVE-2026-114625 (CVSS 9.9), is a SQL injection affecting on-premise VCO versions that grants attackers access to privileged internal functions, provided they hold network access and at least an Enterprise Read Only authenticated session; fixes are available in versions 5.2.3.18, 6.1.3.10, and 6.4.2.12. Arista has not named the attackers but linked two Japan-based IP addresses to the activity, and this marks the third VeloCloud flaw exploited in the wild since July 2026, after CVE-2026-16812 and CVE-2026-93952. Federal agencies are directed to remediate both issues by October 26, 2026.