CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista Velo Cloud
Summary: CISA added two critical-severity vulnerabilities to its Known Exploited Vulnerabilities catalog on Friday, affecting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator, citing reports of active exploitation in the wild. Attackers have used CVE-2026-110447 to backdoor Nextcloud servers with a web shell for reconnaissance and searches for credential stores, password manager artifacts, and cryptocurrency wallets, while CVE-2026-114625 requires network access to the VCO web interface and a valid authenticated session at the Enterprise Read Only role.
What you should know: CVE-2026-114625 is the third flaw in Arista VeloCloud Orchestrator weaponized in the wild since July 2026, after two with CVSS scores of 10.0, and Arista has named only two IP addresses geolocated to Japan without attributing the activity to a threat actor or disclosing how many organizations are affected.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2026-110447CVE-2026-114625CVE-2026-16812CVE-2026-93952
- Related