Two critical vulnerabilities affecting document collaboration and network management infrastructure deserve immediate attention. According to an October 24 report from The Hacker News, CISA has added flaws in Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator to its Known Exploited Vulnerabilities catalog following reports of active exploitation.
For defenders, the practical priority is to identify affected installations, apply the appropriate vendor fixes, and investigate whether exploitation happened before patching. These are different products with different attack requirements: treating them as a single generic “remote attack” risks overlooking the controls and evidence that matter for each.
The vulnerabilities and reported fixes
The Hacker News identifies the following vulnerabilities and fixed releases. Confirm the applicable upgrade path against current vendor guidance before deploying changes, especially where multiple release branches are supported.
| Product | Vulnerability | Reported impact | Reported fixed versions |
|---|---|---|---|
| Collabora Online Built-in CODE Server within Nextcloud | CVE-2026-110447; CVSS 9.2 | Operating system command injection that could enable remote code execution through proxy.php when the local CODE document server is not running | 26.4.303, released in September 2026 |
| On-premises Arista VeloCloud Orchestrator | CVE-2026-114625; CVSS 9.9 | SQL injection that could expose privileged internal functionality | 5.2.3.18, 6.1.3.10, and 6.4.2.12, released in October 2026 |
richdocumentscode. Inventorying only the main Nextcloud application version is therefore insufficient: administrators need to check the installed integration and its version as well.For VeloCloud, the report specifically concerns on-premises Orchestrator deployments. It does not establish that every VeloCloud service or deployment model is affected.
Collabora: look beyond the availability of document editing
The reported Collabora attack condition involves the local document server not running. Do not assume that a broken or unused document-editing feature makes the integration harmless. Equally, keeping the document server running should not be treated as a substitute for installing the fix.
The Hacker News reports that attackers have exploited this vulnerability to place web shells on Nextcloud servers, conduct reconnaissance, and search for credential stores, password-manager artifacts, and cryptocurrency wallets. That reported activity makes post-patch investigation important: updating the vulnerable component does not automatically remove a web shell or invalidate credentials already stolen.
As defensive checks—not confirmed indicators for every intrusion—review unexpected server-side files, unusual web-server child processes, suspicious requests involving the affected component, and unexplained access to sensitive files. Preserve relevant logs and timestamps before remediation changes erase useful evidence. If compromise is suspected, involve incident responders and assess credential exposure rather than limiting the response to an application update.
VeloCloud: a low-privilege account still matters
The reported VeloCloud vulnerability requires network access to the Orchestrator web interface and a valid authenticated portal session. The minimum role identified in the report is Enterprise Read Only. This is not described as an unauthenticated attack, but a read-only account should not be considered a sufficient security boundary against this flaw.
Review which users, service accounts, and network segments can reach the management interface. Remove unnecessary access, restrict management connectivity where operationally feasible, and investigate unexpected sessions or changes to privileged configuration. These measures can reduce exposure while patching is arranged; they do not replace the vendor fix.
Arista has acknowledged active exploitation, according to the report, but has not publicly attributed the activity to a particular threat actor or disclosed the number of affected organizations. The report also says technical details of the exploitation and subsequent attacker actions have not been provided. Avoid filling those gaps with assumptions about specific campaigns or compromise outcomes.
A practical response sequence
- Establish scope. Find Nextcloud installations using Built-in CODE Server and on-premises VeloCloud Orchestrator instances. Record installed versions, ownership, management exposure, and available logs.
- Prioritize affected systems. Give exposed collaboration servers and reachable management interfaces urgent attention. Authenticated exploitation remains relevant wherever accounts or sessions could be misused.
- Patch the correct component and branch. Use vendor-supported packages and upgrade procedures. For Nextcloud, verify the CODE integration itself; for VeloCloud, select the supported fixed release for the deployment.
- Verify functionality and security state. Confirm the installed version after the change, test document editing or orchestration workflows, and check that access restrictions remain intact.
- Investigate pre-patch activity. Review the available exposure window and preserve suspicious evidence. Escalate signs of persistence, unauthorized access, or credential theft through the incident-response process.
Do not confuse a deadline with a safe waiting period
The Hacker News reports an October 26, 2026 remediation date for Federal Civilian Executive Branch agencies. That agency-specific date is not a universal compliance requirement for private organizations, nor does it mean waiting until then is safe.
The immediate decision is simpler: determine whether these components are present and affected, deploy the appropriate fixes, and check for evidence of earlier exploitation. Active exploitation makes both remediation and investigation necessary priorities.
Source: The Hacker News report on the Collabora and Arista VeloCloud vulnerabilities