The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added two critical vulnerabilities impacting the Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its widely monitored Known Exploited Vulnerabilities (KEV) catalog. This urgent addition follows mounting intelligence and direct reports confirming that both security flaws are currently being actively targeted and weaponized by malicious threat actors in the wild.
The inclusion of these vulnerabilities underscores a shifting threat landscape where enterprise infrastructure and document collaboration platforms are increasingly utilized as initial access vectors for sophisticated cybercriminal operations. Federal Civilian Executive Branch (FCEB) agencies have been strongly advised to apply the necessary security updates and vendor-recommended patches by October 26, 2026, to mitigate potential network breaches and safeguard critical government infrastructure from compromise.
The inclusion of the Collabora Online Built-in CODE Server flaw stems from a dangerous exploitation pattern tracked closely by cybersecurity researchers. According to recent threat intelligence reports, malicious actors have been actively leveraging the vulnerability, identified as CVE-2026-110447, to compromise Nextcloud servers. By exploiting this flaw, attackers are able to successfully deploy malicious web shells directly onto target machines.
These persistent web shells serve as covert footholds, allowing unauthorized third parties to conduct deep internal network reconnaissance. Once inside the perimeter, the threat actors systematically search for valuable credential stores, password manager artifacts, and high-value cryptocurrency wallets, aiming to harvest sensitive data and digital assets for financial gain or further espionage. The stealthy nature of these web shell deployments highlights the critical need for organizations utilizing these collaboration tools to verify their patch levels and monitor incoming traffic for anomalous execution behaviors.
Simultaneously, the addition of the Arista VeloCloud Orchestrator vulnerability, designated as CVE-2026-114625, brings renewed attention to ongoing security challenges within software-defined wide-area networking (SD-WAN) management portals. Successful exploitation of this vulnerability requires an attacker to possess prior network access to the VCO web interface, along with a valid, authenticated session on the VCO portal. Notably, the minimum user role required to trigger this critical security flaw is Enterprise Read Only, indicating that attackers who have compromised lower-privileged accounts can potentially leverage this pathway to escalate their privileges or manipulate network orchestration settings.
Despite acknowledging that CVE-2026-114625 is known to be actively exploited in real-world environments, Arista has not yet formally attributed the malicious activity to any specific advanced persistent threat (APT) group or cybercrime syndicate. Furthermore, the vendor has not released detailed technical breakdowns outlining the exact mechanics of how the vulnerability is being manipulated, nor has it disclosed the full scope of post-exploitation actions taken by attackers following successful privilege escalation. The company also has not provided a definitive figure regarding the total number of organizations or enterprise networks impacted by these ongoing campaigns.
In an effort to assist affected organizations and security operations centers with threat hunting and incident response, Arista has shared specific network indicators associated with the hostile traffic. Specifically, the company flagged two IP addresses geolocated to Japan that have been identified as primary drivers behind the malicious activity targeting the VeloCloud infrastructure. Network administrators and security teams are encouraged to review historical and real-time logs for any suspicious interactions involving these identified IP addresses.
The emergence of CVE-2026-114625 marks a concerning milestone for the Arista VeloCloud Orchestrator product line, as it represents the third vulnerability in the exact same software product to be weaponized in the wild since July 2026. This ongoing trend follows a turbulent few months that previously saw the active exploitation of CVE-2026-16812, which carried a maximum CVSS score of 10.0, followed closely by another severe flaw designated as CVE-2026-93952, also carrying a maximum CVSS score of 10.0. The repeated targeting of SD-WAN orchestration platforms demonstrates that malicious actors increasingly view centralized network management tools as high-value targets capable of providing broad visibility and control over enterprise topologies.
As the mandatory remediation deadline set by CISA approaches for federal agencies, private sector organizations relying on either Collabora Online or Arista VeloCloud solutions are strongly urged to review the updated KEV catalog guidance. Implementing rigorous access controls, enforcing multi-factor authentication, and ensuring that all underlying software components are promptly updated will remain critical defenses against the persistent threat of active exploitation campaigns targeting enterprise network environments.
