Collabora Online and Arista VeloCloud — Critical Injection Flaws Under Active Exploitation Campaigns (CVE-2026-110447)

Publication date: October 24, 2026
Category: Vulnerability / Network Security

Introduction

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) catalog to include critical security flaws impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO). As reported by Ravie Lakshmanan on The Hacker News, these vulnerabilities are actively targeted in real-world attacks, prompting urgent patching directives for federal agencies and critical enterprise environments.

What is Collabora Online and Arista VeloCloud? (General Analysis)

The affected technologies fulfill critical roles in modern enterprise infrastructure and document collaboration:

• Collabora Online Built-in CODE Server (richdocumentscode): An integrated application within storage and collaboration platforms like Nextcloud, designed to provide cooperative web-based document editing capabilities.
• Arista VeloCloud Orchestrator (VCO): The centralized management and control platform for Software-Defined Wide Area Network (SD-WAN) architectures, enabling administrators to provision, monitor, and enforce large-scale network policies.

Compromising these platforms grants attackers privileged control over corporate data repositories or the entire software-defined network topology.

(Note: The CVSS vectors and CWE classifications above are confirmed facts retrieved directly from official NVD records).

How Does It Work? (Technical Analysis)

An analysis of the attack vectors highlights intrusion patterns aimed at establishing persistence and rapid privilege escalation:

• Command Injection in Collabora (CVE-2026-110447): The flaw resides in the proxy.php file of the richdocumentscode component. When the local CODE server is inactive (e.g., following a recent product restart), crafted requests sent to the proxy permit operating system command injection. Malicious actors have leveraged this behavior to install web shells on affected Nextcloud servers, facilitating deep reconnaissance, credential harvesting, password manager artifact searches, and cryptocurrency wallet theft.
• Privilege Escalation in Arista VeloCloud (CVE-2026-114625 and related): On-premises versions of VeloCloud Orchestrator contain flaws allowing authenticated users (even with minimal roles such as Enterprise Read Only) to escalate privileges to the “superuser operator” role. This grants access to internal functionality not intended for remote exposure, compromising the confidentiality, integrity, and availability of the orchestrator and managed data.

“The combination of injection flaws and access control breakdowns in network orchestration and document collaboration platforms demonstrates that hybrid attack surfaces remain a prime vector for persistent backdoor deployment.”

Affected Systems / Environments

• Collabora Online Built-in CODE Server: Versions prior to 26.4.303 (specifically the richdocumentscode app within Nextcloud). Standalone Collabora Online servers are not affected by this specific vulnerability.
• Arista VeloCloud Orchestrator (VCO): Vulnerable on-premises versions prior to the October 2026 patches (such as patched versions 5.2.3.18, 6.1.3.10, and 6.4.2.12). Hosted and Dedicated versions have already been patched by the vendor.
• Source Indicators Detected: Specific IP addresses geolocated in Japan (74.82.197[.]86 and 38.54.50[.]151) have been linked to scanning and exploitation activity targeting these vulnerabilities.

Mitigation and Detection

Remediation

1. Immediate Patching: Prioritize the deployment of official vendor patches. For Collabora CODE Server, update to version 26.4.303 or higher. For Arista VCO, apply the fixed versions corresponding to each support branch.
2. Access Restriction: Isolate VeloCloud Orchestrator administration interfaces, restricting access to trusted management networks (corporate VPNs or secure jump hosts) and auditing high-privilege user accounts.
3. Compliance Deadlines: Follow CISA guidelines for federal agencies, establishing strict remediation deadlines across corporate networks.

Detection

• Audit Nextcloud environments for unauthorized modifications to PHP files within CODE application directories, focusing heavily on web shell indicators.
• Review web server and VeloCloud orchestrator access logs for anomalous HTTP requests targeting proxy.php or internal administration endpoints.
• Monitor network traffic for suspicious connections to or from the IP addresses associated with reconnaissance activities.

Wrapping Up

The inclusion of these Collabora Online and Arista VeloCloud vulnerabilities in CISA’s KEV catalog underscores the critical need for strict patch management policies across document collaboration and software-defined networking applications. Active exploitation aimed at deploying backdoors and harvesting credentials highlights the sophistication of threat actors targeting peripheral infrastructure components.

References

• Lakshmanan, R. (2026, October 24). CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud. The Hacker News. https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html
• Cybersecurity and Infrastructure Security Agency. (2026, October 23). Collabora Online Built-in CODE Server. CISA Alerts. https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog-0
• Cybersecurity and Infrastructure Security Agency. (2026, October 23). Arista VeloCloud Orchestrator. CISA Alerts. https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog
• Cybersecurity and Infrastructure Security Agency. (2026). Known Exploited Vulnerabilities Catalog. CISA. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• National Vulnerability Database. (2026). NVD - CVE-2026-110447. National Institute of Standards and Technology. https://github.com/CollaboraOnline/richdocumentscode/issues/354
• National Vulnerability Database. (2026). NVD - CVE-2026-114625. National Institute of Standards and Technology. https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199
• National Vulnerability Database. (2026). NVD - CVE-2026-16812. National Institute of Standards and Technology. https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144
• National Vulnerability Database. (2026). NVD - CVE-2026-93952. National Institute of Standards and Technology. https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183
• VirusTotal. (2026). IP Address Analysis: 74.82.197.86. https://www.virustotal.com/gui/ip-address/74.82.197.86
• VirusTotal. (2026). IP Address Analysis: 38.54.50.151. https://www.virustotal.com/gui/ip-address/38.54.50.151