Exploited Nextcloud CODE server and VeloCloud flaws get 3-day KEV deadline

CISA put two more actively exploited flaws into its Known Exploited Vulnerabilities (KEV) catalog on 23 October, in two separate alerts issued the same day. One is a command injection in the Collabora Online built-in CODE server app that many Nextcloud installations use for in-browser document editing; the other is a SQL injection in on-premises Arista VeloCloud Orchestrator, the management plane for VeloCloud SD-WAN estates. Both carry a federal remediation date of 26 October, three days after listing, and both are flagged for forensic triage, so the instruction is to look for compromise as well as patch.

Two different exposures, one deadline

The two flaws hit very different parts of an organisation. The Collabora issue sits on collaboration servers that are often reachable from the internet so staff can edit files remotely. The VeloCloud issue sits on the orchestrator that pushes configuration to every SD-WAN edge in a branch network. A foothold in either is valuable to an intruder, for different reasons: one exposes the file store, the other the network fabric.

CISA has not tied either CVE to ransomware; its catalog lists ransomware use as unknown for both. Neither alert names a threat group, a count of affected systems, or a targeted sector or country, and none of the cited sources does either.

The VeloCloud Orchestrator flaw

Arista, which assigned CVE-2026-114625 and published it on 22 October under its Security Advisory 0199, describes a SQL injection that lets someone holding an ordinary account on the orchestrator lift themselves to operator rights and act as a built-in superuser operator. That role exposes functions Arista says were meant only for internal use and were never supposed to be reachable over the network. The result reaches past the application to the host underneath, with confidentiality, integrity and availability of the orchestrator and its managed data all at risk.

CISA’s own short description speaks of a remote attacker, while the vendor record makes clear a valid login is needed first. Defenders should hold both facts at once: the bar is low (any user, including a read-only or tenant account), but it is not zero. CISA’s SSVC assessment in the CVE record agrees, rating exploitation active and impact total but marking the attack as not automatable.

Only self-hosted orchestrators need action. Arista says its hosted and dedicated VCO services were affected too and have already been patched on the customer’s behalf. Fixed on-prem releases are:

• 5.2 train: 5.2.3.18 or later
• 6.1 train: 6.1.3.10 or later
• 6.4 train: 6.4.2.12 or later

This is the second exploited on-prem VeloCloud Orchestrator weakness CISA has catalogued in roughly a month, after CVE-2026-93952 was added in September (covered in our roundup of that week’s KEV additions). Teams that patched for that one should confirm they are now on the newer builds listed above rather than assuming the earlier upgrade covers both.

The Collabora CODE server flaw

CVE-2026-110447 affects the bundled CODE server that ships as a Nextcloud app, in every version before 26.4.303. The CVE record, published on 14 October, says it was exploited in the wild during September and October, which means attacks were under way before the CVE was published. It is distinct from the older CVE-2025-66208, so a fix for that issue gives no protection here.

The injection lives in the app’s PHP proxy and is reachable without credentials, but only while the CODE server process is not running, for instance shortly after a restart. That precondition is why the CNA scores it with attack requirements present. It should not be read as a strong mitigation: CISA’s SSVC entry still rates the attack automatable with total technical impact, and routine maintenance restarts create exactly the condition the flaw needs.

Standalone Collabora Online servers are not affected. The exposure is specific to Nextcloud deployments using the built-in CODE app rather than a separate Collabora server.

What to do before 26 October

If only one can be handled today, start with Collabora: it needs no login and CISA rates it automatable, while the orchestrator flaw requires an account and is rated not automatable.

1. Find both products. Check every Nextcloud instance for the richdocumentscode app and its version, and list all on-prem VeloCloud Orchestrators, including lab and standby systems.
2. Capture evidence first on exposed hosts. Both entries require forensic triage under BOD 26-04. CISA’s implementation guidance asks agencies to scope affected systems quickly, capture volatile data such as memory first, then less volatile data such as logs, and only then patch, contain the systems and look for persistence. Patching first can destroy the evidence needed to know whether an intruder got in.
3. Upgrade. Move the CODE app to 26.4.303 or later. Move each orchestrator to the fixed build for its train.
4. Narrow VCO access. Arista’s interim advice in the CVE record is to limit the orchestrator’s web interface to trusted management networks, watch for connections from known-bad addresses and for unexpected outbound traffic, block outbound ports the host does not need, and look for unfamiliar daemons and web shells.
5. Review accounts and changes. On orchestrators, audit user accounts, especially low-privilege ones that could have been used as a starting point, and recent administrator activity. On Nextcloud servers, look for unexpected files, processes and scheduled tasks created by the web server user.
6. If compromise is found, widen the scope. A breached orchestrator can push configuration to every edge it manages, and a breached Nextcloud host holds shared documents and often stored credentials for connected storage. Rotate secrets held on either system.

The 26 October date binds only US federal civilian agencies, but the conditions behind it, internet-facing systems, confirmed attacks and complete takeover on success, apply to any organisation running these products. More exploited flaws are indexed in the CVE search.

Source: Cybersecurity and Infrastructure Security Agency (CISA)