AQSh Kiberxavfsizlik va Infratuzilma Xavfsizligi Agentligi (CISA) juma kuni Collabora Online Built-in CODE Server va Arista VeloCloud Orchestrator (VCO) ga ta'sir qiluvchi ikkita zaiflikni o'zining Ma'lum Ekspluatatsiya Qilinayotgan Zaifliklar (KEV) ro'yxatiga qo'shdi, bu haqda yovvoyi tabiatda faol ekspluatatsiya qilinayotgani haqida xabarlar keltirildi.
Kritik darajadagi zaifliklar quyidagilar:
- CVE-2026-110447 (CVSS balli: 9.2) — Collabora Online – Built-in CODE Server (aka richdocumentscode) da NextCloud platformasi ichida ishlatilganda operatsion tizim buyrug'ini in'ektsiya qilish zaifligi, bu "proxy.php" orqali CODE mahalliy hujjat serveri ishlamayotganida masofaviy kod bajarilishiga imkon beradi. (2026-yil sentyabrda 26.4.303 versiyasida tuzatilgan)
- CVE-2026-114625 (CVSS balli: 9.9) — Arista VeloCloud Orchestrator ning mahalliy (on-premise) versiyalarida SQL in'ektsiya zaifligi, bu masofaviy hujumchiga imtiyozli ichki funksionallikka kirish imkonini beradi. (2026-yil oktyabrda 5.2.3.18, 6.1.3.10 va 6.4.2.12 versiyalarida tuzatilgan)
The Hacker News xabar berganidek, tahdid aktorlari CVE-2026-110447 ni ekspluatatsiya qilib, Nextcloud serverlarini veb-qobiq (web shell) bilan orqa eshik ochish, so'ngra razvedka o'tkazish va hisob ma'lumotlari omborlari, parol menejeri artefaktlari va kriptovalyuta hamyonlarini qidirish uchun foydalanayotgani kuzatilgan.
CVE-2026-114625 ga kelsak, muvaffaqiyatli ekspluatatsiya hujumchidan VCO veb-interfeysiga tarmoq kirishiga va VCO portalida haqiqiy autentifikatsiya qilingan sessiyaga ega bo'lishini talab qiladi. Minimal foydalanuvchi roli — Enterprise Read Only (Korxona Faqat O'qish).
Arista zaiflik "faol ekspluatatsiya qilinayotgani ma'lum" ekanligini tan olgan bo'lsa-da, bu faoliyatni ma'lum bir tahdid aktoriga bog'lamagan va zaiflik qanday ekspluatatsiya qilinayotgani hamda hujumchilar imtiyoz oshirishdan keyin qanday harakatlar qilgani haqida texnik tafsilotlar bermagan. Kompaniya shuningdek, ta'sirlangan tashkilotlar sonini ham oshkor qilmagan.
Biroq, faoliyatni boshqarayotgan deb Yaponiya geolokatsiyasiga ega ikkita IP-manzilni ulashgan:
- [74.82.197[.]86](https://www.virustotal.com/gui/ip-address/74.82.197.86)
- [38.54.50[.]151](https://www.virustotal.com/gui/ip-address/38.54.50.151)
CVE-2026-114625 2026-yil iyulidan beri yovvoyi tabiatda qurolga aylantirilgan shu mahsulotdagi uchinchi zaiflik bo'lib, avvalgi CVE-2026-16812 (CVSS balli: 10.0) va CVE-2026-93952 (CVSS balli: 10.0) dan keyin keladi.
Faol ekspluatatsiya sharoitida, Federal Fuqarolik Ijroiya Tarmog'i (FCEB) agentliklariga tarmoqlarini himoya qilish uchun 2026-yil 26-oktyabrgacha tuzatishlarni qo'llash tavsiya etiladi.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the wild.
The critical-severity vulnerabilities are listed below -
- CVE-2026-110447 (CVSS score: 9.2) - An operating system command injection vulnerability in Collabora Online – Built-in CODE Server (aka richdocumentscode) when used within the NextCloud platform that could allow remote code execution via "proxy.php" when the CODE local document server isn't running. (Fixed in September 2026 in version 26.4.303)
- CVE-2026-114625 (CVSS score: 9.9) - An SQL injection vulnerability in on-premise versions of Arista VeloCloud Orchestrator that could allow a remote attacker to access privileged internal functionality. (Fixed in October 2026 in versions 5.2.3.18, 6.1.3.10, and 6.4.2.12)
As reported by The Hacker News, threat actors have been observed exploiting CVE-2026-110447 to backdoor Nextcloud servers with a web shell so as to conduct reconnaissance and search for credential stores, password manager artifacts, and cryptocurrency wallets.
As for CVE-2026-114625, successful exploitation requires an attacker to have network access to the VCO web interface and a valid authenticated session on the VCO portal. The minimum user role required is Enterprise Read Only.
Although Arista has acknowledged that the vulnerability is "known to be actively exploited," it has not attributed the activity to a particular threat actor or provided technical details on how the vulnerability is being exploited and what actions the attackers took after privilege escalation. The company also has not disclosed the number of affected organizations.
However, it has shared two IP addresses geolocated to Japan as responsible for driving the activity -
- [74.82.197[.]86](https://www.virustotal.com/gui/ip-address/74.82.197.86)
- [38.54.50[.]151](https://www.virustotal.com/gui/ip-address/38.54.50.151)
CVE-2026-114625 is the third vulnerability in the same product to have been weaponized in the wild since July 2026, following CVE-2026-16812 (CVSS score: 10.0) and CVE-2026-93952 (CVSS score: 10.0).
In light of active exploitation, Federal Civilian Executive Branch (FCEB) agencies are recommended to apply the fixes by October 26, 2026, to secure their networks.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.