CISA Adds Collabora and Arista VeloCloud Flaws to Exploited List, Sets Oct. 26 Deadline for Federal Agencies

The Cybersecurity and Infrastructure Security Agency added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on Friday, Oct. 23, citing evidence of active exploitation. Both entries carry a remediation due date of Oct. 26 for Federal Civilian Executive Branch agencies.

That is a three-day window. CISA's catalog entries also flag both flaws as requiring forensic triage, and CISA says it does not know whether either is being used in ransomware campaigns.

Arista VeloCloud Orchestrator: CVE-2026-114625

The bigger of the two stories is the Arista bug. CVE-2026-114625 is a SQL injection flaw in the on-premises version of VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN deployments. Arista acquired that business from VMware.

Arista's Security Advisory 0199, dated Oct. 22, rates the flaw 9.9 on CVSS v3.1 and 9.4 on CVSS v4.0.

The bar to exploit it is low. Any authenticated user can gain operator privileges and impersonate a local "superuser operator," reaching internal functions never meant to be remotely accessible. Arista says even the lowest role, Enterprise Read Only, is enough.

Arista also says VCO is vulnerable by default and that no configuration change prevents the exposure. Hosted VCO versions, including Dedicated, were affected too but have already been patched.

The orchestrator is the control plane for an SD-WAN fabric. Whoever controls it can see and potentially reshape how branch offices, data centers and cloud services connect. Arista warns that exploitation may compromise the confidentiality, integrity and availability of the orchestrator and the data it manages.

Arista says it detected the problem itself and that the flaw is being actively exploited. It has named two source IP addresses tied to the attacks, 74.82.197.86 and 38.54.50.151, and told customers to block both. The Hacker News reports the addresses geolocate to Japan, which says little about who is operating them.

Arista has not attributed the activity to a threat actor. It has not described what attackers did after escalating privileges, and it has not said how many organizations are affected.

Patches and interim steps

Fixes are available in versions 5.2.3.18, 6.1.3.10 and 6.4.2.12 and later. Until they are installed, Arista recommends limiting access to the web interface to administrative networks and watching logs for suspicious activity.

Administrators should look for unusual URL-like path components, encoded characters, references to internal services and high request rates. Those are leads, not proof of compromise.

If an intrusion is suspected, Arista advises saving web, application, system and database logs and relevant file timestamps before starting recovery, where feasible. The company states that these interim controls do not replace upgrading.

A repeat target

CVE-2026-114625 is the third VeloCloud Orchestrator vulnerability exploited in the wild since July 2026. The earlier two, CVE-2026-16812 and CVE-2026-93952, each carried a CVSS score of 10.0.

SC Media, citing Bleeping Computer, counts this as the fourth actively exploited zero-day Arista has patched this year across its products. Arista serves more than 10,000 customers, according to that account.

The Hacker News reports that orchestrators running the releases that fixed the July and September flaws remain exposed to the new one, because those releases predate the latest fixes. By its table, the fix for September's CVE-2026-93952 was listed only for the 5.2 and 6.4 release trains as of Oct. 22, with none listed for 6.1. Arista's advisory page is the place to confirm the status of any given deployment.

Collabora Online CODE server: CVE-2026-110447

The second addition, CVE-2026-110447, is an OS command injection flaw in the Collabora Online Built-in CODE (Collabora Online Development Edition) server when used within Nextcloud. CISA's description says it allows remote code execution. Collabora Online is a self-hosted office suite often integrated into platforms such as Nextcloud and ownCloud.

The Hacker News reports that attackers have exploited the flaw to plant web shells on Nextcloud servers. According to that reporting, the intruders then ran reconnaissance and searched for credential stores, password manager artifacts and cryptocurrency wallets.

The wider catalog

The two additions arrive in a busy stretch for the KEV list. On Oct. 20 CISA added a Siemens Software Center flaw, four Plex Media Server flaws that it says can be chained together, and a SiteGuard Server Edition flaw. Earlier October additions included Fortinet, BeyondTrust, Atlassian, Palo Alto Networks, Cisco, Microsoft and Ivanti products. Due dates across the catalog run from Oct. 11 to Nov. 3.

The KEV deadline binds only federal civilian agencies. CISA urges every organization to fold the catalog into its patching priorities, and where no mitigation is available, to stop using the affected product.

The open questions are on Arista's side: who is exploiting the flaw, how many customers have been compromised, and when 6.1-train customers will get a fix for the September vulnerability. The Oct. 26 federal deadline arrives first.