CISA KEV 23 Oct 2026: 2 exploited flaws in Collabora and Arista
2 vulnerabilities
AI-generated illustration by CyberShitty. Not a photograph or a document from the organisations named.
On 23 October 2026, CISA added 2 actively exploited vulnerabilities affecting Collabora, Arista to its Known Exploited Vulnerabilities catalog. If you run any of these products, patch or mitigate now — exploitation is already happening.
KEV deadlines bind US federal agencies only, but a listing means attackers are already using the flaw, so treat it as a patch-now signal. If one of these products in your organisation was compromised, CERT-In's directions of 28 April 2022 require service providers, intermediaries, data centres, companies and government organisations to report specified incidents within 6 hours of noticing them. How to report an incident to CERT-In.
The vulnerabilities
CVE-2026-110447Federal deadline
Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
Collabora / Collabora Online – Built-in CODE Server / CWE-78
Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA links: BOD 26-04 · Forensics Triage Requirements
Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA links: BOD 26-04 · Forensics Triage Requirements
