Article
Nextcloud Collabora CODE Server Flaw: The Five-Step Playbook (CVE-2026-110447)
CISA added CVE-2026-110447 to KEV. Five steps to find the Collabora CODE app, update to 26.4.303, hunt for web shells and rotate secrets.
Read more
Exploited vulnerability
VeloCloud Orchestrator SQL injection (CVE-2026-114625)
A critical flaw in Arista VeloCloud Orchestrator (VCO) On-Prem, the management server for VeloCloud SD-WAN.
- On CISA KEV
- CVE ID
- CVE-2026-114625
- CVSS
- 9.9 Critical (CVSS v3.1) and 9.4 Critical (CVSS v4.0), as scored by Arista
- CISA KEV
- Listed
- Affected product
- VeloCloud Orchestrator On-Prem (formerly VeloCloud Orchestrator by Broadcom)
- Exploited
- Confirmed by Arista on 22 October 2026 (start date not given)
- Published
- 22 October 2026
In short
CVE-2026-114625 is a critical flaw in Arista VeloCloud Orchestrator (VCO) On-Prem, the management server for VeloCloud SD-WAN. Arista says any authenticated user can gain operator privileges and act as the local superuser operator. Arista tags the flaw as SQL injection (CWE-89). Arista published advisory 0199 on 22 October 2026 and says it detected active exploitation. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 23 October 2026.
- CVECVE-2026-114625
- ProductArista Networks VeloCloud Orchestrator On-Prem (formerly VeloCloud Orchestrator by Broadcom)
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps5actions listedCheck your build · Update to a fixed build
What it allows
Arista says an affected on-prem VCO lets a remote attacker reach privileged internal functionality and affect the VCO host. On an affected system, any authenticated user can gain operator privileges and masquerade as the local superuser operator. That includes functions meant for internal use only.
The VCO is the central management point for the SD-WAN, so control of it matters. Arista says successful exploitation may compromise the confidentiality, integrity and availability of the orchestrator and the data it manages.
Arista tags the flaw with CWE-89, the class for SQL injection. The advisory text itself does not describe the bug in more detail. It does not say who is behind the attacks, when they began or how many systems were hit.
On 23 October 2026, the day CISA added this flaw to the KEV catalog, it also added CVE-2026-110447 in the Collabora Built-in CODE Server app for Nextcloud. See our Collabora CODE Server flaw record and Nextcloud Collabora CODE Server news post.
Another vendor's SD-WAN management system was also attacked in 2026. See our page on the Cisco SD-WAN authentication bypass and the Cisco SD-WAN exploitation it led to.
On 22 October 2026, the day of the Arista advisory, HPE fixed eight ArubaOS flaws rated CVSS 10.0 that need no login. None was known to be exploited at release. The affected and fixed versions are on our page on the HPE ArubaOS authentication bypass and code execution flaws (CVE-2026-79844).
What our X and dark web checks showed on 23 October 2026.
X: we found 54 distinct posts between 22 October and 23 October, almost all outlets and security accounts repeating the advisory. One search-engine account posted an internet-scan query that it said finds about 520 exposed VeloCloud interfaces worldwide; we did not verify that count. One vendor account claimed webshells and lateral movement. Arista's advisory does not say that, so we treat it as unverified.
Dark web monitoring through THANOS: 4 posts mention the CVE id and 16 mention VeloCloud. The VeloCloud posts were on Telegram (13), forums (2) and Discord (1); the 4 CVE posts were all on Telegram, and all were reposts of news articles. These are aggregate counts. We did not run or link any code.
Who is affected
VeloCloud Orchestrator On-Prem, per Arista: 5.2.x releases prior to 5.2.3.18, 6.1.x releases prior to 6.1.3.10, and 6.4.x releases prior to 6.4.2.12. Arista says end of support versions have not been assessed.
Builds from the July fix are not enough. Advisory 0145 of 27 July 2026 named 5.2.3.14, 6.1.3.4 and 6.4.2.4 as fixed for a different bug. Each of those is older than the build this flaw needs.
Arista says hosted VCO, including Dedicated, was affected and has already been patched. Customers on those services do not need to update. Customers who run their own VCO do.
Timeline
- 27 Jul 2026
Arista advisory 0145 fixes a different SQL injection, CVE-2026-17191, in builds 5.2.3.14, 6.1.3.4 and 6.4.2.4.
- 22 Oct 2026
Arista publishes advisory 0199 for CVE-2026-114625 and says the issue was detected by Arista and is known to be actively exploited.
- 22 Oct 2026
The CVE record appears in the National Vulnerability Database, with Arista as the source. By 23 October its status was still Received.
- 23 Oct 2026
CISA adds CVE-2026-114625 to its KEV catalog with a due date of 26 Oct 2026. The entry marks forensic triage as required and known ransomware use as Unknown.
What to do
-
Check your build
Find the VCO version in your own deployment. Anything older than 5.2.3.18, 6.1.3.10 or 6.4.2.12 in its train is affected.
-
Update to a fixed build
Install 5.2.3.18 or later in the 5.2 train, 6.1.3.10 or later in the 6.1 train, or 6.4.2.12 or later in the 6.4 train.
-
Restrict access
Arista advises limiting access to the VCO web interface to trusted administrative networks.
-
Watch the host
Arista advises monitoring for access from known malicious source IPs, for unexpected outbound traffic from the VCO host, and for backdoor daemons and webshells. It also suggests blocking outbound ports that normal operation does not need.
-
Review admin activity
Review recent administrator activity for unexpected changes, since the flaw gives superuser operator rights.
Questions
Is CVE-2026-114625 being exploited?
Yes. Arista's advisory says the issue was detected by Arista and is known to be actively exploited. It does not name the attackers.
Is CVE-2026-114625 in the CISA Known Exploited Vulnerabilities catalog?
Yes. CISA added CVE-2026-114625 to the Known Exploited Vulnerabilities catalog on 23 October 2026, with a due date of 26 October 2026. The entry marks forensic triage as required and lists known ransomware campaign use as Unknown. Its required action points to vendor mitigations and to CISA's BOD 26-04 guidance.
Which VeloCloud Orchestrator versions fix it?
5.2.3.18 and later in the 5.2 train, 6.1.3.10 and later in the 6.1 train, and 6.4.2.12 and later in the 6.4 train.
Do I need to patch hosted VCO?
No. Arista says hosted and Dedicated VCO were affected and have already been patched. The update is for on-prem installs.
Does the attacker need a login?
Yes, a valid session. The advisory says any authenticated user can gain operator privileges. That is why restricting who can reach the web interface matters.
Is this the same as the July 2026 VCO SQL injection?
No. Advisory 0145 of 27 July 2026 covers CVE-2026-17191 and CVE-2026-17192. This one is CVE-2026-114625 in advisory 0199.
In our research
- Nextcloud Collabora CODE Server Flaw: The Five-Step Playbook (CVE-2026-110447) October 2026
- SQL injection Glossary term
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 52 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 26 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 57 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 41 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 71 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.