Executive Summary
- •CISA added two actively exploited vulnerabilities in Collabora Online's Built-in CODE Server and on-premise Arista VeloCloud Orchestrator to its Known Exploited Vulnerabilities catalog.
- •The vulnerabilities carry CVSS scores of 9.2 (CVE-2026-110447) and 9.9 (CVE-2026-114625), marking the third weaponized flaw in Arista VeloCloud Orchestrator since July 2026.
- •Threat actors have used the Collabora flaw to backdoor Nextcloud servers for credentials and crypto wallets, while federal civilian agencies are recommended to patch both flaws by October 26, 2026.
Having three critical bugs weaponized in the same network orchestrator since July is a rough reminder that on-prem management portals are prime real estate for attackers even behind read-only logins.
Key Developments & Data
Zubiqo Strategic Assessment
Primary Impact
Federal Civilian Executive Branch agencies, enterprise network administrators running on-premise Arista VeloCloud Orchestrator, and organizations hosting Nextcloud instances with Collabora Online's Built-in CODE Server.
Strategic Shift
Threat actors are repeatedly targeting network orchestration appliances and self-hosted enterprise collaboration plugins to gain initial footholds and harvest credentials.
The Ripple Effect
Organizations running unpatched on-premise VCO instances or Nextcloud CODE servers face elevated risk of privilege escalation and web shell deployment ahead of the October 26 federal remediation target.
This intelligence assessment is generated by Zubiqo's AI for informational purposes only.
Community Sentiment
The daily signal, delivered every weekday.
A concise weekday briefing on AI, technology and business. Zero PR fluff.
Subscription completes on Substack • Free • 1-click unsubscribe anytime
Intelligence Quality Rating
Grade this brief: Slide & release to submit rating, or tap a preset.
