Built-in Collabora and VeloCloud: two exploited flaws, two deployments to check
CISA added two exploited vulnerabilities on 23 October. Check Nextcloud’s built-in CODE server and on-premises VeloCloud Orchestrator, rather than assuming standalone or hosted products share their status.
Going deeper
Generated image · SecuFocus
At a glance
Key points
If you administer Nextcloud with the built-in Collabora CODE server, check richdocumentscode: versions before 26.4.303 are affected. For on-premises VeloCloud Orchestrator, compare the complete version in your release branch. CISA lists both flaws as known to be exploited and also requires forensic triage. Installing a fix does not establish that the system was never compromised.
Nextcloud: identify the app, not just the server
The NVD record for CVE-2026-110447 concerns Collabora Online Built-in CODE Server, the Nextcloud app richdocumentscode, before 26.4.303. It describes command injection in proxy.php while the CODE server is not running, for example after a restart. A stopped component should not be assumed harmless.
The same record excludes standalone Collabora Online servers from this particular flaw. A Nextcloud installation is not automatically affected: establish whether it uses the built-in server and which version is installed. CISA’s catalog confirms known exploitation; we have not reproduced the attack.
VeloCloud: an authenticated user can become an operator
CVE-2026-114625 concerns on-premises VeloCloud Orchestrator. The vendor description published by NVD says an already authenticated user can gain operator privileges and impersonate a local “superuser operator”. This is not described as access without an account.
The published ranges are 5.2.0 before 5.2.3.18, 6.1.0 before 6.1.3.10, and 6.4.0 before 6.4.2.12. Compare the complete number within your branch. The record says hosted versions, including Dedicated, were affected but have already been patched. That does not update your on-premises orchestrator.
Patching and investigating access are separate tasks
Identify who maintains the component, apply the appropriate remediation and preserve evidence before overwriting it. Both catalog entries mark forensic triage as required. If suspicious signs appear, have the system investigated: an update removes neither persistence nor credentials already stolen.
For a managed service, ask for confirmation of the component and its fix. For a system you maintain, prepare an alternative administration path and check operation after the change. Our self-hosting article covers maintenance and recovery planning.
26 October is a US federal deadline
CISA added both CVEs on 23 October 2026, with 26 October in the due-date field. The directive’s requirements apply to the relevant US federal civilian agencies. This is not a legal deadline for every reader.
For other organizations, the useful signal is established exploitation and the precise deployment involved. Do not wait for an alert on each machine before checking these systems. This article follows public sources, not an examination of your installation.
Check and explore
Sources for this article
Numbers connect each reference to the passages that use it. Dates show when the documentation was consulted.
- NIST NVD: CVE-2026-110447, Nextcloud built-in CODE server ↗services.nvd.nist.gov ·
- NIST NVD: CVE-2026-114625, VeloCloud Orchestrator ↗services.nvd.nist.gov ·
This article draws on the sources above. The exercises are for you to try on your devices; SecuFocus does not present them as tests carried out by its editorial team. Interfaces and features can change. Method and corrections.
Cite this article
Keep this reference with the article when you save or share it.