**CISA** recently issued an alert regarding two critical vulnerabilities being actively exploited in the wild. These high-severity flaws affect widely used enterprise solutions: **Collabora Online Built-in CODE Server** and **Arista VeloCloud Orchestrator (VCO)**. Both have been added to the **KEV** catalog, signaling immediate threat and necessitating prompt mitigation. ### Critical Vulnerabilities Under Scrutiny The two vulnerabilities flagged by **CISA** are: * **CVE-2026-110447** (CVSS score: 9.2): This operating system command injection vulnerability affects **Collabora Online – Built-in CODE Server** (also known as richdocumentscode) when integrated with the **Nextcloud** platform. Exploitation can lead to remote code execution via "proxy.php" if the CODE local document server is not running. A patch was released in September 2026 with version 26.4.303. * **CVE-2026-114625** (CVSS score: 9.9): An SQL injection vulnerability found in on-premise versions of **Arista VeloCloud Orchestrator**. This flaw could allow a remote attacker to gain access to privileged internal functionality. **Arista** addressed this in October 2026 with versions 5.2.3.18, 6.1.3.10, and 6.4.2.12. ### Active Exploitation Details Reports indicate that threat actors have been leveraging **CVE-2026-110447** to backdoor **Nextcloud** servers. The objective appears to be the deployment of web shells for reconnaissance, credential harvesting, and the search for cryptocurrency wallets. For **CVE-2026-114625**, successful exploitation requires network access to the **VCO** web interface and a valid authenticated session. Notably, even an Enterprise Read Only user role is sufficient for an attacker to initiate the exploit. While **Arista** confirmed active exploitation of **CVE-2026-114625**, the company has not attributed the activity to specific threat actors or provided detailed technical insights into the post-exploitation actions. However, two IP addresses, geolocated to Japan, have been identified as sources of the malicious activity: * 74.82.197[.]86 * 38.54.50[.]151 ### A Pattern of Exploitation for Arista VCO **CVE-2026-114625** marks the third vulnerability in the **Arista VeloCloud Orchestrator** product to be weaponized in the wild since July 2026. Prior critical flaws include **CVE-2026-16812** (CVSS score: 10.0) and **CVE-2026-93952** (CVSS score: 10.0), both of which were also actively exploited. ### Call to Action Given the documented active exploitation, **CISA** strongly recommends that Federal Civilian Executive Branch (**FCEB**) agencies apply the necessary patches for these vulnerabilities by October 26, 2026. All organizations using **Collabora Online Built-in CODE Server** within **Nextcloud** or **Arista VeloCloud Orchestrator** are urged to prioritize these updates to safeguard their networks against potential compromise.