Vulnerabilities & Exploits

Collabora backdoors target credential stores as VCO flaws recur

CISA added two actively exploited flaws in Collabora Online Built-in CODE Server and on-prem Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities catalog, with federal civilian agencies given until October 26, 2026, to remediate. The Collabora issue is fixed in 26.4.303; Arista fixed VCO in versions 5.2.3.18, 6.1.3.10, and 6.4.2.12.

The Collabora flaw is operating-system command injection: when its local document server is not running, a request through Nextcloud’s proxy.php can run commands on the host. The Hacker News reports attackers used it to install a web shell and search for credential stores, password-manager artifacts, and crypto wallets. VCO’s separate SQL injection requires network access to its web interface and a valid session with at least Enterprise Read Only privileges, but can reach privileged internal functionality.

For Nextcloud operators, applying the fix cannot show whether artifacts were accessed beforehand; the reporting says attackers searched for them, not whether they were taken. VCO operators face a separate uncertainty: The Hacker News says this is the third VCO flaw weaponized since July, while Arista has not detailed what attackers did after exploitation. Updating alone does not settle whether either host was already compromised.

1 source · 1 day ago

CVE-2026-110447

NVD KEV

Known exploited · CISA KEV

EPSS 2% (83rd percentile).

CISA federal remediation date Oct 26

CVE-2026-114625

NVD KEV

Known exploited · CISA KEV

CVSS 9.9 CRITICAL: veloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host.

CISA federal remediation date Oct 26

Timeline

Sources

Part of the PlainSec briefing for 2026-10-25

Every edition of this story: Collabora backdoors target credential stores as VCO flaws recur

More from today