CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently listed two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) in its Known Exploited Vulnerabilities (KEV) due to evidence of active exploitation. These critical-severity issues, identified as CVE-2026-110447 and CVE-2026-114625, are being actively exploited by threat actors.

CVE-2026-110447 allows for backdoor creation on Nextcloud servers, enabling reconnaissance and discovery of sensitive data such as credential stores, password manager artifacts, and cryptocurrency wallets. On the other hand, CVE-2026-114625 requires network access to the VCO web interface and a valid authenticated session, as well as an Enterprise Read Only user role.

While Arista has acknowledged the active exploitation of CVE-2026-114625, the company has not disclosed the specific methods used by attackers following privilege escalation, nor the number of organizations affected. The two IP addresses associated with Japan have been identified as responsible for the activity.

Federal Civilian Executive Branch (FCEB) agencies are advised to apply the necessary fixes by October 26, 2026, to secure their networks. This ongoing issue highlights the importance of addressing critical vulnerabilities promptly to prevent potential breaches and data theft.