The US Cybersecurity and Infrastructure Security Agency (CISA) on October 23 added two critical flaws to its Known Exploited Vulnerabilities (KEV) catalog: one in Arista's VeloCloud Orchestrator, the management console for its SD-WAN product, and one in the document editing server that ships inside Nextcloud. CISA announced them in two separate alerts, for VeloCloud and Collabora, based on evidence of active exploitation.
A KEV listing means CISA has evidence the bug is being used in real attacks. US federal civilian agencies must remediate under Binding Operational Directive 26-04, and CISA urges every other organization to prioritize the same fixes.
VeloCloud: any logged-in user can act as superuser
CVE-2026-114625 (CVSS 9.4) affects on-premises VeloCloud Orchestrator. CISA's alert labels it a SQL injection. The NVD entry says any authenticated user on an affected system can gain operator privileges and masquerade as a local "superuser operator", reaching functionality intended for internal use only, which can compromise the confidentiality, integrity and availability of the orchestrator and the data it manages. Hosted and dedicated VeloCloud Orchestrator instances were also affected and have already been patched, according to the same record. CISA does not flag the bug as used in ransomware campaigns.
It is not the first VeloCloud Orchestrator flaw on the list this year. CISA flagged another one in July, which we covered here.
Collabora: a restart can open the door
CVE-2026-110447 (CVSS 9.2) is an OS command injection in the Collabora Online Built-in CODE Server, the Nextcloud app (richdocumentscode) that lets users edit office documents in the browser without running a separate Collabora server. According to the NVD record, the flaw sits in proxy.php and is reachable when the CODE server is not running, for example after the product was recently restarted, and it allows remote code execution. The record states it was exploited in the wild in September and October 2026 and that it is a different bug from CVE-2025-66208. Standalone Collabora Online servers are not affected; only Nextcloud deployments using the built-in CODE Server are.
Update CODE Server to 26.4.303 and patch on-prem VCO
Nextcloud administrators using the built-in CODE Server should update richdocumentscode to version 26.4.303 or later. Because exploitation was already under way in September, instances that were reachable from the internet before patching deserve a compromise check, not just an update. For VeloCloud Orchestrator, on-premises operators should apply the fixed release named in Arista's advisory, which carries the affected and patched versions, and review operator-level accounts and activity for signs of abuse. BOD 26-04 itself sets the expectation that agencies check whether a system was compromised before the patch went on, which is sound practice for everyone else too.
Collaboration servers and network management consoles sit close to the data and the plumbing an attacker wants most, and in both cases the attackers got there before the catalog did.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.