Ethical Hacking News
CISA has added two high-priority vulnerabilities to its Known Exploited Vulnerabilities list, highlighting the urgent need for prompt patching and a heightened state of vigilance among organizations. The vulnerabilities, CVE-2026-110447 and CVE-2026-114625, have already been reported as actively exploited in the wild, prompting organizations to take immediate action to secure their networks and prevent potential cyber-attacks.
Two vulnerabilities, CVE-2026-110447 and CVE-2026-114625, have been issued a critical alert by CISA, prompting organizations to take immediate action.CVE-2026-110447 affects Collabora Online's Built-in CODE Server and allows remote code execution via "proxy.php".CVE-2026-114625 is an SQL injection vulnerability affecting Arista VeloCloud Orchestrator and allows privileged access with network access and a valid authenticated session.The vulnerabilities have already been reported as actively exploited in the wild, and FCEB agencies are recommended to apply fixes by October 26, 2026.Organizations are advised to maintain a heightened state of vigilance and take prompt action to patch their networks and prevent potential cyber-attacks.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert on two vulnerabilities impacting Collabora Online and Arista VeloCloud, prompting organizations to take immediate action to patch their networks and prevent potential cyber-attacks. The vulnerabilities, listed as CVE-2026-110447 and CVE-2026-114625, have already been reported as actively exploited in the wild, highlighting the urgent need for prompt patching and a heightened state of vigilance among organizations.
CVE-2026-110447, a critical-severity vulnerability with a CVSS score of 9.2, affects Collabora Online's Built-in CODE Server. When used within the NextCloud platform, this vulnerability can allow remote code execution via "proxy.php" when the CODE local document server isn't running. The vulnerability was fixed in September 2026 in version 26.4.303. According to The Hacker News, threat actors have been observed exploiting this vulnerability to backdoor Nextcloud servers with a web shell, thereby conducting reconnaissance and searching for credential stores, password manager artifacts, and cryptocurrency wallets.
On the other hand, CVE-2026-114625, with a CVSS score of 9.9, is an SQL injection vulnerability affecting on-premise versions of Arista VeloCloud Orchestrator. This vulnerability allows a remote attacker to access privileged internal functionality with an attacker needing only network access to the VCO web interface and a valid authenticated session on the VCO portal. The minimum user role required for this vulnerability is Enterprise Read Only. Although Arista has acknowledged that the vulnerability is "known to be actively exploited," it has not attributed the activity to a particular threat actor or provided technical details on how the vulnerability is being exploited and what actions the attackers took after privilege escalation. However, it has shared two IP addresses geolocated to Japan as responsible for driving the activity - 74.82.197[.]86 and 38.54.50[.]151.
CVE-2026-114625 is the third vulnerability in the same product to have been weaponized in the wild since July 2026, following CVE-2026-16812 and CVE-2026-93952. In light of active exploitation, Federal Civilian Executive Branch (FCEB) agencies are recommended to apply the fixes by October 26, 2026, to secure their networks.
The addition of these vulnerabilities to the Known Exploited Vulnerabilities list by CISA underscores the importance of regular vulnerability assessments and proactive patching. It highlights the need for organizations to maintain a heightened state of vigilance and to be proactive in addressing potential cyber threats. Organizations must take prompt action to patch their networks and prevent potential cyber-attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/CISA-Adds-Two-High-Priority-Vulnerabilities-to-Its-Known-Exploited-Vulnerabilities-List-Highlighting-Urgent-Need-for-Prompt-Patching-ehn.shtml
https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html
https://nvd.nist.gov/vuln/detail/CVE-2026-110447
https://www.cvedetails.com/cve/CVE-2026-110447/
https://nvd.nist.gov/vuln/detail/CVE-2026-114625
https://www.cvedetails.com/cve/CVE-2026-114625/
Published: Sat Oct 24 02:57:06 2026 by llama3.2 3B Q4_K_M
