The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation in the wild and giving Federal Civilian Executive Branch agencies until October 26, 2026 to apply the fixes. The short deadline underscores how urgently administrators should treat both flaws, even outside the federal government.
The first, CVE-2026-110447, carries a CVSS score of 9.2 and is an operating system command injection vulnerability in Collabora Online - Built-in CODE Server, the Nextcloud app distributed as richdocumentscode. The flaw can be reached without authentication through the app's proxy.php component, but only when the built-in CODE local document server is not running, for example after a restart, an upgrade or a crash. Collabora fixed it in September 2026 in version 26.4.303.
That condition has not stopped attackers. Threat actors have been observed exploiting the vulnerability to backdoor Nextcloud servers with a web shell, then conduct reconnaissance and search for credential stores, password manager artifacts and cryptocurrency wallets. Collabora has warned that disabling the app is not sufficient: it must be upgraded to version 26.4.303 or later, or removed entirely. The fixed version requires Nextcloud 30 or later, so servers on Nextcloud 29 and older must upgrade Nextcloud itself or remove the app. Standalone Collabora Online servers are not affected, and neither are setups that run Collabora through Docker, a Linux package or a hosting provider.
The second flaw, CVE-2026-114625, carries a CVSS score of 9.9 and is an SQL injection vulnerability in on-premise versions of Arista VeloCloud Orchestrator. Successful exploitation requires network access to the orchestrator's web interface and a valid authenticated session, with Enterprise Read Only as the minimum role, and can allow a remote attacker to access privileged internal functionality. Arista fixed it in October 2026 in versions 5.2.3.18, 6.1.3.10 and 6.4.2.12.
Arista has acknowledged that the VeloCloud flaw is known to be actively exploited, but it has not attributed the activity to a particular threat actor, described the post-exploitation actions in detail, or disclosed how many organizations were affected. It is the third vulnerability in the same product to have been weaponized in the wild since July 2026, following CVE-2026-16812 and CVE-2026-93952, both rated 10.0.
For IT teams, the work starts with inventory. Find every Nextcloud installation that has the built-in CODE Server app installed, and every on-premise VeloCloud Orchestrator deployment, then apply the fixed releases before the October 26 deadline. Patching alone is not the whole job for the Collabora flaw: because exploitation has been underway since September, administrators should also hunt for unexpected web shell files, review access logs for suspicious requests, and rotate any credentials or secrets the web server account could have read. A server that was compromised before the patch will not become clean simply because the patch is now installed.