CISA Adds CVE-2026-110447 and CVE-2026-114625 to KEV Catalog Citing Active Exploitation
CISA added two critical, actively exploited vulnerabilities in Collabora Nextcloud and Arista VeloCloud to its KEV catalog. Exploitation evidence is strongest for the Nextcloud RCE; Arista provided only two Japanese IPs. The Arista product shows a recurring exploitation pattern across three CVEs since July.
CISA's KEV entry for CVE-2026-110447 notes remote code execution through the richdocumentscode component when the local CODE server is disabled, with observed deployment of web shells targeting credential stores and crypto wallets. CVE-2026-114625 requires an authenticated Enterprise Read Only session on the VCO web interface and permits access to privileged internal functions. Arista disclosed two Japanese IPs (74.82.197.86 and 38.54.50.151) as the observed sources but released no payload samples or post-exploitation telemetry. CVE-2026-114625 marks the third Arista VeloCloud flaw added to KEV since July 2026, following two CVSS 10.0 issues. Procurement records show VeloCloud Orchestrator is deployed in multiple federal and critical-infrastructure environments, creating a concentrated attack surface. The repeated pattern indicates either sustained reconnaissance of the product or incomplete patch deployment across on-premise instances. Technical attribution remains limited to the two IPs; no independent verification of state actor involvement exists. Official statements emphasize active exploitation while withholding actor details or victim counts. Federal Civilian Executive Branch agencies must patch both vulnerabilities by 26 October 2026 under Binding Operational Directive requirements.
CISA: A fourth Arista VeloCloud vulnerability will enter the KEV catalog before 31 March 2027
Sources (2)
- [1]CISA Known Exploited Vulnerabilities Catalog(https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [2]Arista Networks Security Notice(https://www.arista.com/en/support/advisories-notices)