CISA KEV Alert: Collabora Online and Arista VeloCloud Flaws Under Active Attack

On Friday, October 23, the U.S. Cybersecurity and Infrastructure Security Agency added two critical, actively exploited vulnerabilities to its CISA KEV (Known Exploited Vulnerabilities) catalog. One affects Nextcloud servers running the built-in Collabora Online document editor. The other affects Arista's VeloCloud Orchestrator, the control centre for many companies' SD-WAN networks. Attackers are already using both, and US federal agencies have until Monday, October 26 to patch.

You don't have to be a US government agency for this to matter. A CISA KEV listing is one of the clearest signals in security that a bug has moved from "theoretical" to "being used against real victims right now." If you run Nextcloud for your team or manage an SD-WAN network, here's what happened, how to check whether you were hit, and how to fix it this weekend.

The short version

• CVE-2026-110447 (CVSS 9.2): command injection in Collabora Online's Built-in CODE Server app for Nextcloud. Attackers have used it to plant web shells and hunt for password vaults and crypto wallets. Fix: update the app to 26.4.303 or later, or remove it. Disabling it is not enough.

• CVE-2026-114625 (CVSS 9.9): SQL injection in on-premises Arista VeloCloud Orchestrator. Any logged-in user, even with the lowest read-only role, can become a top-level operator. Fix: upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later.

• Both are on the CISA KEV list because of confirmed real-world attacks.

• Patching closes the hole but doesn't remove an attacker who is already inside. Check for signs of compromise too.

  

The two CISA KEV additions side by side: who is at risk, how attackers get in, and how to fix it.

What is the CISA KEV catalog, and why should you care?

The CISA KEV catalog is a public list of vulnerabilities that CISA has confirmed attackers are exploiting in the wild. To be added, a bug needs a CVE ID, evidence of active exploitation and clear guidance on how to fix it.

For US federal civilian agencies, a KEV listing comes with a deadline. Under CISA's Binding Operational Directive 26-04, agencies must prioritise these fixes, especially on internet-facing systems where a successful attack gives full control. The directive also sets expectations for checking whether attackers got in before the patch was applied.

For everyone else, CISA "encourages all organizations" to use the same approach, and it's good advice. Most organisations can't patch thousands of vulnerabilities at once. The KEV list tells you which ones attackers are actually using, so you know where to start. If something on your network appears in the CISA KEV catalog, it should jump to the front of the queue.

Flaw 1: Collabora Online's built-in CODE server for Nextcloud (CVE-2026-110447)

Who is affected?

Nextcloud is a popular self-hosted alternative to Google Drive and Dropbox, used by companies, schools and privacy-minded teams. To edit documents in the browser, many admins install Collabora Online - Built-in CODE Server (the app ID is richdocumentscode). It runs a small copy of the Collabora document server directly on the Nextcloud machine, so you don't need a separate server.

That built-in app is the vulnerable part:

• Affected: all versions of richdocumentscode before 26.4.303

• Not affected: standalone Collabora Online servers, and the Nextcloud Office app (richdocuments) when used without the built-in CODE server

How does the attack work?

The app includes a script called proxy.php, which starts the local document server when a request arrives and the server isn't running. In vulnerable versions, the script placed part of the incoming web request, including the URL path, inside a shell command. If an attacker put shell syntax such as $(...) into the URL, the server executed it.

There's one condition: the bug can only be triggered while the local document server is down, for example during a restart, an upgrade or after a crash. That sounds limiting, but servers restart more often than people think, and attackers can simply keep trying.

The script also runs without loading Nextcloud's own security code, and it runs as the web server user. That user can read Nextcloud's files, configuration and anything else on the box that it has access to.

What did attackers actually do?

Three Nextcloud admins reported compromised servers on GitHub, and their logs give a clear picture. The first logged attack hit on September 10, 2026, against a server running version 26.4.302. The attacker:

1. Dropped a tiny one-line PHP web shell into the app's folder, a backdoor that runs any command sent to it in a URL.

2. Sent the server's system details to a webhook.site address to confirm the hack worked.

3. Used the shell to search for valuables: KeePass databases (*.kdbx), Bitcoin wallet.dat files, keystore.json, and anything mentioning Bitwarden, 1Password, Electrum, Monero or Ethereum.

The logs that were reviewed showed no evidence of files being copied out, and no attacker reached root (one server logged failed sudo attempts). But the admin who reported it gave sensible advice: treat anything the web server account could read as potentially exposed.

The awkward timeline

This one is a lesson in how patches and warnings can be out of step:

Date (2026)What happenedAug 20Fix written by a Collabora developerAug 31Version 26.4.302 released, still vulnerableSep 10First logged attackSep 11Fixed version 26.4.303 released, with release notes that didn't mention securityOct 3Nextcloud forum warns the flaw is being exploitedOct 14Official advisory and CVE publishedOct 23CISA adds it to the KEV catalog

So a fix was available from September 11, but anyone reading the release notes had no reason to rush. It took more than a month before an official advisory said "this is a security issue." If you only patch when an advisory tells you to, this gap is where you get caught.

How do I fix the Collabora Online vulnerability?

Run these as your web server user (often www-data) from your Nextcloud folder:

# Is the built-in CODE server installed, and which version?
sudo -u www-data php occ app:list | grep -A1 richdocumentscode

# Update it (you need 26.4.303 or later)
sudo -u www-data php occ app:update richdocumentscode

# Or remove it completely if you don't need it
sudo -u www-data php occ app:remove richdocumentscode

Three things to know:

• Disabling the app does not fix it. The vulnerable script can still be reached. Update or remove it.

• Nextcloud 29 and older can't install the fix, because 26.4.303 needs Nextcloud 30 or later. Upgrade Nextcloud, or remove the app.

• Some admins reported startup and document-opening problems with the later 26.4.402 release and went back to 26.4.303. Either version contains the fix.

How do I check if my Nextcloud server was hacked?

Because attacks started on September 10, check your server even if you've already patched:

# 1. Look for web shells (attackers used names like shx5cf91.php)
find /path/to/nextcloud -name 'shx*.php' -o -name 'shr*.php'

# 2. Search web logs back to Sept 10 for attack attempts
grep 'richdocumentscode/proxy.php' /var/log/apache2/access.log* \
  | grep -E '%2e%2e|\$\(|\$\{IFS\}|base64'

# 3. Check for sudo attempts by the web server user
grep 'www-data' /var/log/auth.log* | grep sudo

Adjust the paths for Nginx or your distribution. Also look for connections to webhook.site and to the IP addresses 139.28.18[.]122 and 89.38.98[.]50 (remove the brackets before searching).

If you find a shell file, don't just delete it and move on. Assume everything the web server could read was exposed. That includes database passwords in config.php, API keys, and any password-manager or wallet files on the machine. Rotate those secrets. This is the same "assume the web user's view is compromised" thinking we covered in our PHP2Shell web server guide, since Nextcloud is a PHP app with the same risks.

Flaw 2: Arista VeloCloud Orchestrator (CVE-2026-114625)

What is VeloCloud Orchestrator?

VeloCloud is an SD-WAN product. SD-WAN connects a company's branch offices, data centres and cloud services over the internet as if they were one private network. The Orchestrator (VCO) is the central management console that controls all of it: network policies, customer accounts and settings for every connected site. You may know it by its old name, VMware SD-WAN by VeloCloud. Arista acquired the product line from Broadcom in 2025.

Whoever controls the orchestrator effectively controls the network built on top of it, which is why attackers keep going after it.

What does the bug allow?

CVE-2026-114625 is an SQL injection flaw, rated 9.9 out of 10. An attacker who can reach the VCO web interface and has any valid login, even the lowest built-in "Enterprise Read Only" role, can escalate to operator, the highest level of control. According to Arista, they can then act as a local superuser and potentially expose, change or disrupt the orchestrator and the data it manages.

Requiring a login sounds reassuring, but think about who has read-only accounts in a typical deployment: partners, managed service providers, contractors and junior staff. One phished password from any of them is enough. Credential theft campaigns like GhostAction's phishing and OAuth attacks show how easily that happens.

Third time this year

This is the third exploited VeloCloud Orchestrator flaw since July 2026, after CVE-2026-16812 in July and CVE-2026-93952 in September, both rated a maximum 10.0. Importantly, versions that fixed those earlier bugs are still vulnerable to this one, so being "patched in September" doesn't protect you.

Arista confirmed the flaw is "known to be actively exploited." It hasn't named the attackers, said how many organisations were hit, or explained what attackers did after gaining control. It has shared two IP addresses, geolocated to Japan, linked to the attacks: 74.82.197[.]86 and 38.54.50[.]151.

How do I fix the VeloCloud Orchestrator vulnerability?

Release trainUpgrade to5.25.2.3.18 or later6.16.1.3.10 or later6.46.4.2.12 or later7.0Not affectedEnd-of-support releasesNot assessed. Contact Arista TAC

Some key points:

• Only on-premises orchestrators need action. Arista says its Hosted and Dedicated orchestrators are already patched.

• VeloCloud Edge and Gateway devices are not affected by this bug.

• Arista notes that VCO is exposed by default, and no setting inside VCO prevents that. You have to restrict access at the network level.

What should I do until I can upgrade?

Arista's interim advice:

• Allow access to the VCO web interface only from trusted admin networks, using a firewall, VPN or zero-trust access gateway. Our look at Cloudflare Gateway's programmable security covers one way to put admin panels behind identity-based access.

• Block and search your logs for the two attacker IPs.

• Watch for unexpected outbound connections from the VCO host, and block outbound ports it doesn't need.

• Look for web shells and unfamiliar background processes.

• Review recent admin activity, new accounts and configuration changes.

• Check web access logs for strange URL paths, encoded characters, references to internal services, and bursts of requests.

• Audit who holds read-only accounts, and remove any that aren't needed.

If you suspect a compromise, preserve evidence before you upgrade: web, application, system and database logs plus file timestamps. Arista hasn't said whether upgrading removes access an attacker already gained, so an upgrade alone shouldn't be treated as a clean-up.

What is the bigger lesson from these CISA KEV additions?

On the surface, these bugs have little in common. One is a document editor add-on and the other is network management software. But they share three patterns worth learning from.

1. Management and "helper" software is a prime target. Neither bug is in the main product people think about. One is in an optional add-on for Nextcloud, the other in the console that manages a network. These tools often run with broad access and get less security attention, which makes them attractive to attackers.

2. "Patched" and "safe" aren't the same thing. The Collabora fix existed weeks before anyone called it a security fix, and VeloCloud users who patched the July and September bugs were still exposed to this one. Keep updating continuously, and don't wait for an advisory to explain why.

3. Patching doesn't evict intruders. CISA's directive specifically expects agencies to check for compromise that happened before the patch. That applies to everyone: after patching anything on the KEV list, look for web shells, new accounts and strange outbound traffic.

We cover critical CVEs like these as they land, for example the Siemens CVE-2026-110936 flaw. But the practical habit is to subscribe to the CISA KEV catalog (it has an RSS feed and a downloadable list), compare it against what you actually run, and treat any match as urgent. It's free, it's short, and it focuses your effort on the vulnerabilities attackers are actually using.

Quick checklist

• Nextcloud: update richdocumentscode to 26.4.303 or later, or remove it (not just disable it)

• Nextcloud 29 or older: upgrade Nextcloud or remove the app

• Nextcloud: search for shx*.php files and suspicious proxy.php requests since September 10; rotate secrets if anything turns up

• VeloCloud on-prem: upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later

• VeloCloud: restrict the VCO web interface to trusted networks, block the two attacker IPs, and review read-only accounts

• Both: preserve logs, check for compromise, then patch

• Going forward: monitor the CISA KEV catalog and match it against your inventory

Sources: The Hacker News: CISA flags two exploited flaws · CISA alert: VeloCloud KEV addition · CISA alert: Collabora KEV addition · The Hacker News: Nextcloud backdoor attacks · The Hacker News: Arista VeloCloud advisory · CISA KEV catalog