CISA's deadline for U.S. federal agencies is October 26 and covers two entries added on the 23rd: Arista's VeloCloud Orchestrator and Collabora Online. The first weighs more, because Arista itself writes that it detected the flaw and knows it is being actively exploited.
Fact
The facts: on October 22, 2026 Arista published advisory 0199 for CVE-2026-114625 in self-hosted VeloCloud Orchestrator (VCO): CVSSv3.1 9.9 and CVSSv4.0 9.4. According to Arista, any authenticated user can gain operator privileges and masquerade as the local superuser operator user. An attack needs network access to the web interface and a valid authenticated session on the portal; the minimum role is Enterprise Read Only. Arista writes that it detected the issue and that it is known to be actively exploited. Affected are VCO 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10 and 6.4.x before 6.4.2.12; hosted versions, Dedicated included, are already patched. The advisory says no configuration can prevent the exposure. Arista classifies it as CWE-89, SQL injection, and CISA lists it under the same name. On October 23, 2026 CISA added to its Known Exploited Vulnerabilities (KEV) catalog this entry and a second one, CVE-2026-110447, for Collabora Online, built-in CODE server, both with a deadline of October 26. Collabora's advisory (GHSA-g3vx-3m76-fghh, published October 14) describes CVE-2026-110447 as critical (CVSS v4 9.2): on Nextcloud with the Collabora Online - Built-in CODE Server app (richdocumentscode), an unauthenticated request through proxy.php can run an operating system command as the web server user; versions before 26.4.303 are affected and the fix is 26.4.303. Collabora's advisory does not mention attacks.
The difference from September's flaw in the same product is the entry point. Then Arista's advisory described an attacker without credentials. Now a valid session is required, but an account with the Enterprise Read Only role is enough, which the advisory lists as the minimum.
No setting can save you. A version can.
This time a fix exists for all three branches. Until you update, Arista advises limiting access to the web interface to trusted networks, watching for unknown outbound traffic and reviewing the logs, and it lists two addresses to block. That is defense in depth, not a fix.
Collabora is a different story. The advisory is from October 14; the news is the listing on the 23rd. What is affected is Nextcloud with the built-in CODE server, and only while that server is not running: on a container restart, on an upgrade or after a crash. Standalone Collabora Online servers are not affected. And disabling the app is not enough: you have to upgrade it to 26.4.303 or later, or remove it.
Who is attacking and since when, how many installations are affected, and whether Collabora has seen attacks - neither advisory says.
For VeloCloud Orchestrator on your own server, the version must be 5.2.3.18, 6.1.3.10 or 6.4.2.12 and up in its branch. For the richdocumentscode app in Nextcloud, you are looking for 26.4.303, and on Nextcloud 29 or older Collabora advises upgrading Nextcloud itself or removing the app.
Official primary sources
Arista Security Advisory 0199 (CVE-2026-114625), 22.10.2026CISA KEV (CVE-2026-114625, CVE-2026-110447), 23.10.2026CISA BOD 26-04 - Prioritizing Security Updates Based on Risk (for FCEB federal agencies)Collabora GHSA-g3vx-3m76-fghh (CVE-2026-110447), 14.10.2026The visual is generated code-art, no third-party images.