US federal civilian agencies must fix a command-injection bug in the Collabora Online built-in server app for Nextcloud and an SQL injection in Arista’s VeloCloud Orchestrator by 26 October; CISA lists both as exploited.
CISA added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalogue on Friday and gave federal civilian agencies until today to fix them. CVE-2026-110447 lets an unauthenticated attacker run commands through the Collabora Online built-in CODE server app for Nextcloud while that local document server is not running; users on Nextcloud’s community forum reported finding web shells on servers as early as 3 October. The fix is version 26.4.303 of the app, and the advisory says disabling the app is not enough: it must be upgraded or removed. Standalone Collabora servers are not affected. CVE-2026-114625 is an SQL injection in on-premises Arista VeloCloud Orchestrator, fixed in 5.2.3.18, 6.1.3.10 and 6.4.2.12; Arista says any logged-in user, down to the lowest read-only role, can exploit it, and hosted versions are already patched. For both flaws, CISA’s catalogue entries also require forensic triage of affected systems under its new directive, BOD 26-04; neither entry flags known ransomware use.
Sources: CISA alert (Arista) · CISA alert (Collabora) · CISA KEV catalog · Collabora advisory · Nextcloud community forum · Arista Security Advisory 0199 · The Hacker News