Affected Systems

Collabora Online Built-in CODE Server (richdocumentscode) within NextCloud platform, fixed in version 26.4.303 (September 2026). Arista VeloCloud Orchestrator on-premise versions, fixed in 5.2.3.18, 6.1.3.10, and 6.4.2.12 (October 2026). CVE-2026-110447 (CVSS 9.2) and CVE-2026-114625 (CVSS 9.9).

Exploitation Status

Active exploitation confirmed for both vulnerabilities. CVE-2026-110447 used to deploy web shells on NextCloud servers for reconnaissance, credential theft, and cryptocurrency wallet searches. CVE-2026-114625 exploited from two IP addresses in Japan (74.82.197.86, 38.54.50.151); requires authenticated session with minimum Enterprise Read Only role and network access to VCO web interface.

Business Impact

Organizations running vulnerable Collabora Online with NextCloud face remote code execution risk via command injection in proxy.php when CODE server is not running. Arista VCO customers face SQL injection enabling privilege escalation to internal functionality. This is the third actively exploited VeloCloud vulnerability since July 2026. Threat actors targeting credential stores, password managers, and crypto wallets. FCEB agencies must patch by October 26, 2026.

Urgency

đź”´ Immediate

Recommended Actions

  • Immediately upgrade Collabora Online Built-in CODE Server to version 26.4.303 or later if using NextCloud integration
  • Upgrade Arista VeloCloud Orchestrator on-premise installations to versions 5.2.3.18, 6.1.3.10, or 6.4.2.12 depending on branch
  • Block inbound traffic from 74.82.197.86 and 38.54.50.151 at perimeter firewalls and review VCO logs for connections from these IPs
  • Audit NextCloud servers for web shells, unauthorized file modifications in web directories, and suspicious outbound connections since September 2026
  • Review VCO authentication logs for anomalous Enterprise Read Only account activity and privilege escalation attempts since July 2026

---

# Geopolitical Context

Geopolitical Context

The addition of CVE-2026-110447 and CVE-2026-114625 to CISA's Known Exploited Vulnerabilities catalog reflects ongoing threats to enterprise collaboration and network infrastructure platforms. The targeting of Nextcloud servers via the Collabora vulnerability—with threat actors seeking credential stores, password managers, and cryptocurrency wallets—is consistent with financially motivated or espionage-oriented campaigns. The Arista VeloCloud Orchestrator flaw represents the third actively exploited vulnerability in that product since July 2026, suggesting sustained adversary interest in software-defined WAN infrastructure used by enterprises and service providers. The exploitation activity originating from IP addresses geolocated to Japan may indicate use of proxy infrastructure rather than attribution to Japanese actors. The rapid weaponization of these flaws underscores the challenge federal agencies and critical infrastructure operators face in maintaining defensive posture against opportunistic and targeted intrusion campaigns.

State Actor Alignment

No state actor attribution is provided in available reporting. The exploitation patterns—targeting credential repositories, cryptocurrency wallets, and privileged enterprise network management functions—are consistent with both advanced persistent threat (APT) operations and organized cybercrime. The use of IP addresses geolocated to Japan for the VeloCloud attacks may reflect adversary use of compromised or leased infrastructure rather than origin. CISA's mandate for Federal Civilian Executive Branch agencies to remediate by October 26, 2026, signals U.S. government concern over potential targeting of federal networks, though no specific threat actor or nation-state linkage has been disclosed by CISA or Arista.

Business Impacty pro region

The vulnerabilities affect widely deployed enterprise collaboration and SD-WAN platforms with global user bases, creating exposure across North America, Europe, and Asia-Pacific. The Nextcloud/Collabora flaw poses particular risk to organizations in the European Union and privacy-conscious sectors that have adopted open-source collaboration suites as alternatives to U.S. cloud providers. The sustained exploitation of Arista VeloCloud Orchestrator—now the third critical flaw weaponized in three months—may prompt reassessment of SD-WAN security posture among multinational enterprises and managed service providers. The October 26 remediation deadline for U.S. federal agencies may drive coordinated patching efforts among Five Eyes partners and allied governments operating similar infrastructure. Organizations in Japan should investigate whether the geolocated IP addresses reflect compromised domestic infrastructure being leveraged for broader campaigns.

Forecast

If threat actors continue to prioritize SD-WAN and collaboration platforms, additional vulnerabilities in Arista VeloCloud and similar enterprise networking products are likely to be discovered and exploited in the coming months. Should the Nextcloud/Collabora exploitation campaign expand, open-source collaboration platforms may face increased scrutiny from regulators and enterprise security teams, potentially accelerating migration to commercially supported alternatives or driving investment in enhanced monitoring. If the IP addresses geolocated to Japan are confirmed as compromised infrastructure, Japanese CERT coordination may yield additional indicators and victim notifications. Absent attribution or technical details from Arista regarding post-exploitation activity, incident responders at affected organizations may face challenges scoping intrusions and determining data exposure. If federal agencies fail to meet the October 26 remediation deadline, CISA may escalate enforcement or reporting requirements under Binding Operational Directive 22-01.