Weekly Security Brief: Collabora and Arista Flaws Exploited

CISA added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog on October 23, 2026. One affects the built-in CODE Server in Collabora Online, the other the on-premises Arista VeloCloud Orchestrator. Both carry a US federal remediation deadline of October 26, 2026.

Collabora Online Built-in CODE Server

The flaw is an operating system command injection. When the built-in CODE Server is used inside the Nextcloud platform, a remote attacker can run code on the system if the CODE server is not running. In practice, that means an attacker could take control of the machine hosting the document-editing service.

Organizations that run Nextcloud with the built-in CODE Server should treat this as a priority. CISA’s required action is to apply mitigations following the vendor’s instructions, in line with its BOD 26-04 guidance on prioritizing security updates based on risk and its forensics triage requirements. Where mitigations are not available, CISA says to discontinue use of the product. Whether ransomware groups have used the flaw is unknown.

Arista VeloCloud Orchestrator

The on-premises VeloCloud Orchestrator contains a SQL injection flaw. A remote attacker could reach privileged internal functions and affect the orchestrator host. CISA describes the possible result as a compromise of the confidentiality, integrity and availability of the orchestrator and the data it manages.

Network administrators who run their own orchestrator, rather than a vendor-hosted one, are the ones to check. The required action is the same: apply the vendor’s mitigations, follow BOD 26-04 guidance (including its cloud-service provisions where relevant), complete the forensics triage steps, or stop using the product if no mitigation exists. Ransomware use is listed as unknown.

What the deadlines mean

The October 26 due dates are binding for US federal civilian agencies. For everyone else they are a useful benchmark: a flaw on this list is already being used in attacks, and a deadline only three days after listing signals high urgency.

What to do this week

• Check whether you run Collabora Online’s built-in CODE Server with Nextcloud, or an on-premises Arista VeloCloud Orchestrator.
• Apply the vendor’s update or mitigation for each affected product, or take the product out of service if none is available.
• Review logs and systems for signs of compromise on affected hosts, following CISA’s forensics triage requirements.
• Limit internet exposure of management and orchestration interfaces wherever possible.