AI Agent UpdateCISA flags two actively exploited flaws — Collabora and Arista — with an October 26 patch deadline
Two flaws already being exploited in the wild, one federal patch deadline, and a weekend to get it done.
The News
America's cybersecurity agency has flagged two more flaws that attackers are already exploiting, and the clock to patch them runs out on October 26. The US Cybersecurity and Infrastructure Security Agency (CISA) added both flaws to its Known Exploited Vulnerabilities (KEV) catalog on October 24, citing active exploitation, with a federal patch deadline of October 26 for both. The KEV catalog is the US government's list of flaws known to be actively exploited in the real world, so these are not theoretical risks: someone is already using them.
The first flaw is in Collabora Online, tracked as CVE-2026-110447, with a CVSS severity score of 9.2 out of 10. It is an OS command injection flaw in the Built-in CODE Server used within Nextcloud, a popular self-hosted alternative to cloud office suites. Unauthenticated attackers — meaning attackers who do not need a username or password — can execute commands via proxy.php when the built-in CODE server is not running, for example after a restart, an upgrade or a crash. It was fixed in version 26.4.303, released in September 2026. Reported exploitation included deploying PHP web shells, which are hidden backdoors on a server, and stealing configuration files containing credentials and secrets.
The second flaw is in Arista's VeloCloud Orchestrator (VCO), tracked as CVE-2026-114625, with a CVSS score of 9.9 out of 10 — about as severe as the scale gets. It is a SQL injection flaw in the on-premise version of VCO, which lets remote attackers access privileged internal functions: in plain words, tricking the database with crafted input to reach parts of the system that should be off-limits. Fixed versions are 5.2.3.18, 6.1.3.10 and 6.4.2.12. Arista has named no threat actor, given no exploitation details and no count of affected organisations, but this is the third weaponised VCO vulnerability since July 2026, a pattern that should worry any VCO operator.
A 9.9 severity flaw with no named attacker and no victim count is not reassurance — it is a reason to patch now.
Why It Matters
Start with why the KEV list carries weight. Security researchers find thousands of flaws every year, and most are never exploited. The KEV catalog is the short list of exceptions: flaws that CISA has confirmed are being used in real attacks. Landing on it is the difference between 'fix this when you can' and 'fix this now, because attackers already know about it.' A federal deadline of October 26, just two days after listing, underlines how urgent CISA considers these two flaws.
The Collabora flaw shows the practical damage. When an attacker can run commands on a server without logging in, they can plant a web shell — a hidden backdoor that lets them return whenever they like — and read configuration files that often contain passwords and secret keys. Those secrets can then unlock other systems. The trigger condition is also easy to miss: the flaw is exploitable when the built-in CODE server is not running, which happens during ordinary events like restarts, upgrades and crashes. In other words, the vulnerable window opens during routine maintenance.
The Arista flaw matters for a different reason: pattern and opacity. A single severe flaw can be bad luck; a third weaponised vulnerability in the same product since July 2026 is a trend, and it suggests attackers are paying sustained attention to VeloCloud Orchestrator. Arista's silence on who is exploiting it and how widely only increases the uncertainty for operators, who must patch without knowing whether they are already compromised. Collabora and Nextcloud are private companies, so there is no direct stock to watch there; Arista is the public name carrying the direct exposure.
Analyst's Take
This is a Bearish verdict, and the reason is the combination of severity, exploitation and silence. Two flaws scoring 9.2 and 9.9, both already being exploited, with a patch deadline measured in days rather than weeks, is a bad week for defenders on its own. The Arista side is worse in one specific way: the vendor has said nothing about who is exploiting it, how, or how many organisations are affected. That information vacuum does not mean nothing is happening; for the Collabora flaw, the reported exploitation shows exactly what happens when these flaws are left open — backdoors planted and secrets stolen.
For investors, the read-through is narrow but real. Arista Networks (ANET) is the direct name here: a third weaponised flaw in its orchestration product since July raises questions about the security of that product line, even if the broader business is far larger than VCO. Palo Alto Networks (PANW) is included only as a security read-through peer — a company in the same defensive industry whose fortunes rise with demand for protection, not a company involved in either flaw. The wider lesson is the same as every KEV week: patching is not paperwork, it is the defence. Readers' poll: does your team patch KEV flaws on day one, or does it take a deadline to move?
By The Numbers
FAQ
What is CISA's Known Exploited Vulnerabilities catalog?
KEV is the US government's list of security flaws that are known to be actively exploited — that is, attackers are already using them in the real world, not just in theory. When a flaw lands on the KEV list, US federal agencies are given a deadline to patch it. The list is watched far beyond government, because if attackers are exploiting a flaw against some organisations, they will try it against others too.
What do CVSS scores and SQL injection mean?
CVSS is a severity score out of 10, where higher means more dangerous: a 9.2 or 9.9 is about as severe as flaws get. SQL injection is a trick where an attacker types specially crafted input into a system so that the database behind it runs commands it should not. In plain words, it is like slipping a forged instruction into a form and having the filing clerk obey it.
Am I affected if I use Nextcloud or Arista products?
Only if your organisation runs the specific affected products: Collabora Online's Built-in CODE Server, or an on-premise Arista VeloCloud Orchestrator. Ordinary users of other software are not directly affected, but the reported exploitation — web shells and stolen configuration files in the Collabora case — shows why administrators of those products should patch before the October 26 federal deadline rather than waiting.
Source: The Hacker News / CISA