CISA Issues Warning on Vulnerabilities in Nextcloud and Arista VCO

a computer screen with a bunch of code on it — Chris Ried / Unsplash

The Cybersecurity and Infrastructure Security Agency (CISA) issued a warning on October 23, 2026, regarding two vulnerabilities that have been confirmed to be exploited.

CISA added the vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including "CVE-2026-110447" related to the "Collabora Online - Built-in CODE Server" and "CVE-2026-114625" for the "VeloCloud Orchestrator (VCO)".

"CVE-2026-110447" is an OS command injection vulnerability identified in the additional application "Built-in CODE Server" provided by Collabora, which is integrated into the online storage solution "Nextcloud" for document editing. If a crafted request is sent while the embedded document editing server is not running, there is a risk that remote OS commands could be executed without authentication.

The developer has released a fix in version "26.4.303". Simply disabling the application will not suffice as a mitigation; users are advised to either update or remove the application entirely.

On the other hand, "CVE-2026-114625" is a SQL injection vulnerability found in Arista Networks’ network management product "VeloCloud Orchestrator" designed for SD-WAN environments. Exploitation requires access to the management interface and an authenticated session, allowing for privilege escalation and access to internal management functions.

CISA has set a response deadline of October 26 for U.S. government agencies regarding these vulnerabilities. Agencies are advised not only to remediate the vulnerabilities but also to investigate for any potential breaches.