The US Cybersecurity and Infrastructure Security Agency (CISA) has added two further actively exploited flaws to its Known Exploited Vulnerabilities (KEV) catalogue, covering Collabora Online and Arista's VeloCloud Orchestrator, with a remediation deadline of 26 October 2026 for US federal civilian agencies.

Collabora Online command injection

The first flaw, CVE-2026-110447, rated 9.2, is an operating-system command injection in Collabora Online's built-in CODE Server for Nextcloud, via proxy.php when the local CODE server is not running. It is fixed in version 26.4.303, released in September 2026, and standalone Collabora Online servers are not affected. Reported exploitation includes the planting of PHP web shells, reconnaissance, and hunting for credential stores, password-manager artefacts and crypto wallets.

Arista VeloCloud SQL injection

The second flaw, CVE-2026-114625, rated 9.9, is a SQL injection flaw in on-premises Arista VeloCloud Orchestrator, fixed in versions 5.2.3.18, 6.1.3.10 and 6.4.2.12. Exploitation is reported to need network access to the orchestrator's web interface and a valid session, with a minimum role of Enterprise Read Only. It is the third VeloCloud flaw reported weaponised since July 2026. Arista has not named a threat actor or disclosed how many organisations are affected, and the exact number affected for Collabora is also not established. These are different flaws from the PHP2Shell vulnerabilities already covered in a separate DailyByte post.

Sources: The Hacker News; CyberSecureFox summary of CISA KEV, October 2026.