Arista VeloCloud and Collabora Nextcloud Flaws Exploited in the Wild
Attackers are exploiting vulnerabilities in Arista VeloCloud Orchestrator and the Collabora Online Built-in CODE Server used with Nextcloud, according to a report published by Heise on October 26. The campaigns can expose privileged VeloCloud functions and allow unauthenticated operating-system command injection against affected Nextcloud installations. CISA has warned about both attacks, while the available fixes identify specific upgrade paths for administrators.
Arista VeloCloud Orchestrator
The VeloCloud issue, tracked as CVE-2026-114625, is a critical SQL injection vulnerability in the on-premises VeloCloud Orchestrator. Network-based attackers can reach privileged internal functions without authorization. An authenticated user can also impersonate a “Superuser Operator”, gaining access to functions that should not be exposed to the internet. The report says the vulnerability is already being attacked, although the scale and precise form of the attacks are not known.
Arista lists VCO versions 5.2.3.18, 6.1.3.10 and 6.4.2.12 as fixed. Until an update is installed, administrators should restrict access through firewalls and VPNs to trusted endpoints. The report says VCO is reachable from the internet by default and that hosted VCO instances have already been secured by Arista. Administrators can also block and search logs for the reported attacker addresses 74.82.197.86 and 38.54.50.151.
Collabora Online Built-in CODE Server
The second vulnerability, CVE-2026-110447, affects the proxy.php code in Collabora Online’s Built-in CODE Server for Nextcloud. It allows unauthenticated attackers to inject operating-system commands that run under the web server’s account. Exploitation is possible while the built-in server is stopped, such as during a container restart, an upgrade or recovery from a crash. Disabling the app in Nextcloud does not prevent the attack.
The fixed app version is 26.4.303 or later, and it requires Nextcloud 30 or later. Administrators running an unsupported Nextcloud version up to and including 29 should upgrade Nextcloud or remove the app. Standalone Collabora servers are not affected. Issue-tracker reports dated September 11 describe webshells installed through “richdocumentscode”, so administrators with the app installed should check their systems for intrusion indicators and apply the update if necessary.