THE U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog, affecting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO). The advisory notes that these flaws are being exploited in the wild, prompting coordinated response and remediation by affected organisations.
CVE-2026-110447 (CVSS 9.2) is an operating system command injection in Collabora Online’s Built-in CODE Server (also known as richdocumentscode) when used within NextCloud. Successful exploitation allows remote code execution via proxy.php if the CODE local document server is not running, with fixes released in September 2026 in version 26.4.303.
The second vulnerability, CVE-2026-114625 (CVSS 9.9), is an SQL injection in on‑prem Arista VeloCloud Orchestrator that could permit an attacker to access privileged internal functionality. Arista states it is known to be actively exploited; mitigation relies on versions 5.2.3.18, 6.1.3.10, and 6.4.2.12, patched in October 2026.
Evidence of exploitation for CVE‑2026‑110447 includes threat actors backdooring Nextcloud servers with a web shell to conduct reconnaissance and locate credential stores and cryptocurrency wallets. For CVE‑2026‑114625, activity is tied to two IPs geolocated to Japan, with no attribution to a specific threat actor disclosed. In response, the US Federal Civilian Executive Branch agencies are urged to apply the fixes by 26 October 2026 to safeguard networks.