CISA flags actively exploited critical flaws in Arista VeloCloud Orchestrator and Collabora Online
Network orchestration and document collaboration platforms sit close to credentials and internal traffic, so a compromise there can become a route to wider access. Organisations that self-host these products should confirm exposure and patch status, and review servers for web shells and unusual access to credential stores. The reported targeting of wallets is a reminder that opportunistic attackers monetise any foothold quickly.
What Happened
CISA added an SQL injection vulnerability in on-premise Arista VeloCloud Orchestrator (CVE-2026-114625) to its Known Exploited Vulnerabilities catalog on 23 October 2026. The Hacker News reported that a second flaw, an OS command injection in Collabora Online's built-in CODE server used within Nextcloud (CVE-2026-110447), was also added, with federal agencies told to patch by 26 October. The same report said attackers had used the Collabora flaw to install web shells on Nextcloud servers and search for credential stores and cryptocurrency wallets.
Why It Matters
Network orchestration and document collaboration platforms sit close to credentials and internal traffic, so a compromise there can become a route to wider access. Organisations that self-host these products should confirm exposure and patch status, and review servers for web shells and unusual access to credential stores. The reported targeting of wallets is a reminder that opportunistic attackers monetise any foothold quickly.
Sources
- CISA (opens in a new tab): CISA Adds One Known Exploited Vulnerability to Catalog (2026-10-23)
- The Hacker News (opens in a new tab): CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud (2026-10-24)
More From This Briefing
- CISA adds PHP 'php2shell' remote code execution flaws to Known Exploited Vulnerabilities catalog
- Malaysia names SoftBank as investor behind proposed US$50 billion AI and data centre programme
- Zerohash and Majority launch stablecoin remittances to Latin America
This story is part of the Laurenceo Intelligence briefing for 27 October 2026, a daily sourced briefing on AI, technology and enterprise risk published in Bermuda by Laurenceo, founded by Jorai Laurenceo. It is produced by an automated research pipeline and checked before publication; how this is made. General information only, not legal, regulatory or financial advice.