CISA flags critical vulnerabilities in Collabora Online and Arista VeloCloud

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog due to reports of active exploitation in the wild.

One vulnerability, CVE-2026-110447 (CVSS 9.2), affects Collabora Online Built-in CODE Server when used within the Nextcloud platform. This operating system command injection flaw allows remote code execution. Threat actors have reportedly used this flaw to backdoor Nextcloud servers with web shells to conduct reconnaissance and search for credentials and cryptocurrency wallets.

The second vulnerability, CVE-2026-114625 (CVSS 9.9), is an SQL injection flaw in on-premises versions of the Arista VeloCloud Orchestrator (VCO). This flaw allows an authenticated user, even with the minimum 'Enterprise Read Only' role, to escalate privileges and access restricted internal functionality. Arista has acknowledged active exploitation of this flaw, though it has not attributed the activity to a specific threat actor.