CISA added two actively exploited vulnerabilities to its catalog: CVE-2026-110447 in the Nextcloud Collabora Online Built-in CODE Server and CVE-2026-114625 in Arista VeloCloud Orchestrator.
Review remediation versions and deployment status.
The problem with Nextcloud
The first issue is in Collabora Online, specifically its built-in server when used within the Nextcloud platform. This vulnerability could allow an attacker to execute remote commands. Attackers have exploited the issue to install backdoors on Nextcloud servers, in order to search for stored passwords, digital wallets, and password manager files. The company has been releasing a fix for this issue since September 2026.
The problem with Arista VeloCloud Orchestrator
The second issue affects local versions of Arista VeloCloud Orchestrator, a network management system. This vulnerability could allow a remote attacker to gain access to internal system functions. To do this, the attacker would need network access to the administration page, an active account, and read-only permissions. Arista released fixes for this issue in October 2026.
The company has not attributed the attacks to any specific group or revealed how many organizations have been affected. However, it did release two IP addresses linked to the malicious activity that are geographically located in Japan: 74.82.197.86 and 38.54.50.151This is the third time since July 2026 that a security issue has been identified in the same Arista system that is actively used in attacks, following previous issues. The relevant US authorities had recommended that federal agencies implement the relevant fixes by October 26, 2026.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)