Two Critical Flaws Under Active Attack: CISA Warns on Collabora Online and Arista VeloCloud

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical-severity vulnerabilities to its Known Exploited Vulnerabilities catalogue, citing reports of active exploitation. They affect the Collabora Online Built-in CODE Server and the Arista VeloCloud Orchestrator (VCO).

For the Collabora flaw (CVE-2026-110447), The Hacker News has reported that attackers have been exploiting it to plant a web shell, a hidden backdoor, on Nextcloud servers. They then conduct reconnaissance and search for credential stores, password manager artifacts and cryptocurrency wallets.

The Arista flaw (CVE-2026-114625) requires an attacker to have network access to the VCO web interface and a valid authenticated session. The lowest user role needed is Enterprise Read Only. Arista has confirmed the flaw is known to be actively exploited, but it has not named a threat actor, explained how the attacks work, or said how many organisations are affected. It has shared two IP addresses geolocated to Japan as linked to the activity. This is the third VCO vulnerability exploited in the wild since July 2026, after two earlier flaws that each carried a CVSS score of 10.0.

US federal civilian agencies have been told to apply fixes by October 26, 2026.