Back
Two critical flaws exploited in Nextcloud and SD-WAN: Collabora CODE and Arista VeloCloud
On 23 October 2026, CISA added two critical flaws to its Known Exploited Vulnerabilities (KEV) catalog and gave federal agencies until 26 October to patch. One hits the built-in office server in Nextcloud, widely used for file sharing; the other, the SD-WAN orchestrator that manages branch networks.
| Collabora Online — Built-in CODE Server | Arista VeloCloud Orchestrator (VCO) | |
|---|---|---|
| CVE | CVE-2026-110447 | CVE-2026-114625 |
| Type | OS command injection (unauthenticated) | SQL injection (requires at least an "Enterprise Read Only" session) |
| CVSS | 9.2 | 9.9 |
| Affected | Nextcloud's richdocumentscode app before 26.4.303; standalone Collabora Online servers are not affected | On-premises VCO |
| Fixed in | 26.4.303 and later | 5.2.3.18, 6.1.3.10, 6.4.2.12 |
Collabora CODE: An open door during downtime
The flaw allows command execution through proxy.php while the local office server is not running (during a restart, update or crash). Attacks have been observed since 10 September. The attackers dropped PHP web shells in the app directory and searched for password manager and crypto wallet files.
- Do: update the
richdocumentscodeapp to 26.4.303 or later, or remove it. According to the vendor, simply disabling the app is not enough. - Look for: unexpected PHP files such as
shx*.phpunderapps/richdocumentscode/; command injection traces such as$(or${IFS}inproxy.php?statusrequests in the access logs; failed sudo attempts by the web server account. - Remember: look for web shells on patched servers too. Treat any credentials readable by the web server account as exposed and rotate them.
Arista VeloCloud: The third exploited flaw since July
Arista has confirmed active exploitation; this is the third VCO flaw exploited since July 2026. Because an attacker can reach privileged internal functions even with a low-privilege account, a stolen password becomes far more dangerous.
- Do: upgrade VCO to one of the fixed versions above; take the management interface off the internet and make it reachable only from the management network.
- Look for: connections from 74.82.197[.]86 and 38.54.50[.]151, the addresses shared by Arista; unexpected activity by "Read Only" accounts.
- Remember: reset all VCO user passwords and API keys, and enforce multi-factor authentication.
How Nokta Guard can help
In our external network and web application tests we identify your internet-facing management interfaces and file sharing servers and verify their patch status. Our vulnerability management service keeps that picture up to date.
Related services: External Network Penetration Testing, Vulnerability Management
Sources: The Hacker News · eSecurity Planet