CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog due to active exploitation. CVE-2026-110447 is a command injection flaw in Collabora Online’s Built-in CODE Server used within Nextcloud, allowing remote code execution via a proxy.php endpoint when the document server is offline. Threat actors have exploited this vulnerability to deploy web shells on Nextcloud servers for reconnaissance and credential harvesting. CVE-2026-114625 is a critical SQL injection vulnerability in on-premise Arista VeloCloud Orchestrator instances, exploitable by authenticated attackers with read-only access, enabling access to privileged internal functionality. Arista confirmed active exploitation and identified two malicious IP addresses linked to the attacks, both geolocated to Japan.

AI-extracted · verify before operational use