- CISA added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog, citing active exploitation targeting cryptocurrency wallets.
- The flaws affect Collabora Online CODE Server (CVSS 9.2) and Arista VeloCloud Orchestrator (CVSS 9.9), with patches available.
- Attackers exploited CVE-2026-110447 to backdoor Nextcloud servers and search for credential stores and cryptocurrency wallets.
- Arista’s vulnerability is the third in its product exploited since July 2026, following two previous critical flaws.
- Federal agencies must apply fixes by October 26, 2026, to secure their networks.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog on Friday, warning of active exploitation targeting cryptocurrency assets. The flaws affect Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator, according to CISA alerts.
The first vulnerability, CVE-2026-110447, carries a CVSS score of 9.2 and allows remote code execution via command injection in the NextCloud platform’s CODE server. Threat actors have exploited this flaw to backdoor Nextcloud servers with a web shell, conducting reconnaissance for credential stores, password manager artifacts, and cryptocurrency wallets.
The second vulnerability, CVE-2026-114625, has a CVSS score of 9.9 and is an SQL injection in on-premise Arista VeloCloud Orchestrator. Successful exploitation requires network access to the VCO web interface and a valid authenticated session with at least Enterprise Read Only role.
Arista acknowledged active exploitation but did not attribute the activity to a specific threat actor or disclose the number of affected organizations. The company shared two IP addresses geolocated to Japan as responsible. This marks the third vulnerability in the same product exploited since July 2026, following two previous flaws with CVSS scores of 10.0.
Consequently, Federal Civilian Executive Branch agencies must apply the fixes by October 26, 2026, to secure their networks. Patches for the Collabora vulnerability were released in September 2026, and fixes for the Arista flaw are available in versions 5.2.3.18, 6.1.3.10, and 6.4.2.12.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
