On October 23, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two distinct vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog based on evidence of active exploitation: CVE-2026-114625 in VeloCloud Orchestrator (VCO) On-Premise and CVE-2026-110447 in Collabora Online Built-in CODE for Nextcloud. Administrators should check the affected deployment and use the fix for that product.
| Vulnerability and affected product | Flaw and applicable condition | Fixed release | Administrator action |
| CVE-2026-114625, VCO On-Premise | SQL injection; requires network access to the VCO web interface and an authenticated portal session. | 5.2.3.18 or later in 5.2; 6.1.3.10 or later in 6.1; 6.4.2.12 or later in 6.4. | Upgrade VCO On-Premise; restrict web-interface access to trusted administrative networks until patched. |
CVE-2026-110447, Collabora Online Built-in CODE for Nextcloud (richdocumentscode) | Command injection through proxy.php when the built-in server is not running. | 26.4.303 or later. The fixed app requires Nextcloud 30 or later. | Update the app or remove it. Disabling it alone is insufficient. |
Check VeloCloud Orchestrator On-Premise
CVE-2026-114625 affects supported VCO On-Premise branches 5.2.x, 6.1.x and 6.4.x below the fixed releases shown in the table. Arista says successful exploitation requires both network access to the VCO web interface and a valid authenticated portal session; Enterprise Read Only is the minimum built-in role. The flaw is not an unauthenticated VCO attack. Arista assigns it a CVSS score of 9.9 under version 3.1 and 9.4 under version 4.0.
Arista says hosted VCO deployments, including Dedicated deployments, had already been patched. Administrators should check their on-premises installation against its release branch. Arista also recommends blocking 74.82.197.86 and 38.54.50.151, which it lists as observed attack-source IP addresses, and searching VCO logs for them. Until the upgrade is installed, restrict access to trusted administrative networks. If compromise is suspected, preserve relevant web-access, backend-application, system and database logs, along with filesystem timestamps, before remediation where feasible. Arista’s Security Advisory 0199 provides the branch-specific fixes and response guidance.
Update or remove Collabora Built-in CODE
CVE-2026-110447 affects the Nextcloud app richdocumentscode, not standalone Collabora Online servers. Collabora says the command-injection flaw can run an operating-system command as the web-server user without prior authentication when the built-in CODE server is not running, such as during a restart or upgrade, or after a crash.
Disabling the app does not address the vulnerability. Update it to the fixed release in the table or remove it. If the installation runs Nextcloud 29 or earlier, Collabora says to upgrade Nextcloud or remove the app; the fixed app requires Nextcloud 30 or later. Collabora also says this flaw follows a different path from CVE-2025-66208, so that earlier fix does not prevent CVE-2026-110447. The Collabora security advisory details the affected app and remediation.
Reported Nextcloud activity and CISA’s directive
On October 26, Heise reported that issue-tracker entries and user reports of web shells on Nextcloud servers dated back to at least September 11, 2026. That is a reported chronology of activity involving richdocumentscode.
CISA’s binding directive, BOD 26-04, applies to U.S. Federal Civilian Executive Branch agencies. CISA encourages other organizations to prioritize vulnerabilities in the KEV catalog.
