---
title: CISA Issues Warning on Vulnerabilities in Nextcloud and Arista VCO
url: https://www.dataloco.com/en/cisa-issues-warning-on-vulnerabilities-in-nextcloud-and-arista-vco
published: 2026-10-28T17:20:36+00:00
language: en
section: Security
source: https://www.security-next.com/191926
organizations: cisa, arista, nextcloud, vco
publisher: Dataloco
---

# CISA Issues Warning on Vulnerabilities in Nextcloud and Arista VCO

The Cybersecurity and Infrastructure Security Agency (CISA) issued a warning on October 23, 2026, regarding two vulnerabilities that have been confirmed to be exploited.

CISA added the vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including "CVE-2026-110447" related to the "Collabora Online - Built-in CODE Server" and "CVE-2026-114625" for the "VeloCloud Orchestrator (VCO)".

"CVE-2026-110447" is an OS command injection vulnerability identified in the additional application "Built-in CODE Server" provided by Collabora, which is integrated into the online storage solution "Nextcloud" for document editing. If a crafted request is sent while the embedded document editing server is not running, there is a risk that remote OS commands could be executed without authentication.

The developer has released a fix in version "26.4.303". Simply disabling the application will not suffice as a mitigation; users are advised to either update or remove the application entirely.

On the other hand, "CVE-2026-114625" is a SQL injection vulnerability found in Arista Networks’ network management product "VeloCloud Orchestrator" designed for SD-WAN environments. Exploitation requires access to the management interface and an authenticated session, allowing for privilege escalation and access to internal management functions.

CISA has set a response deadline of October 26 for U.S. government agencies regarding these vulnerabilities. Agencies are advised not only to remediate the vulnerabilities but also to investigate for any potential breaches.

## This story in other languages

- [中文](https://www.dataloco.com/zh/nextcloudarista-vco)
- [Polski](https://www.dataloco.com/pl/amerykanska-agencja-ostrzega-przed-lukami-w-nextcloud-i-arista-vco)
- [Deutsch](https://www.dataloco.com/de/cisa-warnt-vor-sicherheitsanfalligkeiten-in-nextcloud-und-arista-vco)
- [Español](https://www.dataloco.com/es/cisa-advierte-sobre-vulnerabilidades-en-nextcloud-y-arista-vco)
- [ไทย](https://www.dataloco.com/th/nextcloud-arista-vco)
- [Svenska](https://www.dataloco.com/sv/cisa-varnar-for-sarbarheter-i-nextcloud-och-arista-vco)
- [Русский](https://www.dataloco.com/ru/cisa-preduprezdaet-ob-uiazvimostiax-v-nextcloud-i-arista-vco)
- [Français](https://www.dataloco.com/fr/alerte-de-securite-sur-des-vulnerabilites-dans-nextcloud-et-arista-vco)
- [العربية](https://www.dataloco.com/ar/ththyr-mn-thghrat-amny-fy-adoat-nextcloud-oarista-vco)
- [Nederlands](https://www.dataloco.com/nl/cisa-waarschuwt-voor-kritieke-fouten-in-nextcloud-en-arista-vco)
- [Português (Brasil)](https://www.dataloco.com/pt-br/cisa-alerta-sobre-vulnerabilidades-em-nextcloud-e-arista-vco)
- [Norsk](https://www.dataloco.com/no/cisa-advarer-om-sarbarheter-i-nextcloud-og-arista-vco)