Vulnerabilities · 1 day ago

Collabora backdoors target credential stores as VCO flaws recur

CISA added two actively exploited flaws in Collabora Online Built-in CODE Server and on-prem Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities catalog, with federal civilian agencies given until October 26, 2026, to remediate. The Collabora issue is fixed in 26.4.303; Arista fixed VCO in versions 5.2.3.18, 6.1.3.10, and 6.4.2.12.

The Collabora flaw is operating-system command injection: when its local document server is not running, a request through Nextcloud’s proxy.php can run commands on the host. The Hacker News reports attackers used it to install a web shell and search for credential stores, password-manager artifacts, and crypto wallets. VCO’s separate SQL injection requires network access to its web interface and a valid session with at least Enterprise Read Only privileges, but can reach privileged internal functionality.

For Nextcloud operators, applying the fix cannot show whether artifacts were accessed beforehand; the reporting says attackers searched for them, not whether they were taken. VCO operators face a separate uncertainty: The Hacker News says this is the third VCO flaw weaponized since July, while Arista has not detailed what attackers did after exploitation. Updating alone does not settle whether either host was already compromised.

CVE-2026-110447

NVD KEV

Known exploited · CISA KEV

EPSS 2% (83rd percentile).

CISA federal remediation date Oct 26

CVE-2026-114625

NVD KEV

Known exploited · CISA KEV

CVSS 9.9 CRITICAL: veloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host.

CISA federal remediation date Oct 26

Timeline

Oct 26 CISA federal deadline for CVE-2026-110447
Oct 24 Reported by The Hacker News
Oct 23 CVE-2026-110447 added to CISA KEV

Sources

1 source covering this story

The Hacker News Oct 24
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
CISA adds exploited Collabora Online and Arista VeloCloud flaws to KEV, with federal agencies directed to patch by October 26.

Entities

CVE-2026-110447
CVE-2026-114625

Part of the PlainSec briefing for 2026-10-25

Editions

Briefing for 2026-10-25

Vulnerabilities · 1 day agoCollabora backdoors target credential stores as VCO flaws recurCISA added two actively exploited flaws in Collabora Online Built-in CODE Server and on-prem Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities catalog, with federal civilian agencies given until October 26, 2026, to remediate. The Collabora issue is fixed in 26.4.303; Arista fixed VCO in versions 5.2.3.18, 6.1.3.10, and 6.4.2.12.The Collabora flaw is operating-system command injection: when its local document server is not running, a request through Nextcloud’s proxy.php can run commands on the host. The Hacker News reports attackers used it to install a web shell and search for credential stores, password-manager artifacts, and crypto wallets. VCO’s separate SQL injection requires network access to its web interface and a valid session with at least Enterprise Read Only privileges, but can reach privileged internal functionality.For Nextcloud operators, applying the fix cannot show whether artifacts were accessed beforehand; the reporting says attackers searched for them, not whether they were taken. VCO operators face a separate uncertainty: The Hacker News says this is the third VCO flaw weaponized since July, while Arista has not detailed what attackers did after exploitation. Updating alone does not settle whether either host was already compromised.

CVE-2026-110447

NVD KEV

Known exploited · CISA KEV

EPSS 2% (83rd percentile).

CISA federal remediation date Oct 26

CVE-2026-114625

NVD KEV

Known exploited · CISA KEV

CVSS 9.9 CRITICAL: veloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host.