Clearance Incident Response. Free through May 1, so you have time to patch.Measure in 5 min. Free AssessmentFree Assessment

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In October 2026, CISA added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-110447 (CVSS 9.2), an OS command injection flaw in Collabora Online's Built-in CODE Server enabling remote code execution via proxy.php on Nextcloud platforms, and CVE-2026-114625 (CVSS 9.9), an SQL injection vulnerability in Arista VeloCloud Orchestrator allowing remote attackers with only read-only access to reach privileged internal functionality. Active exploitation of CVE-2026-110447 involved web shell implantation on Nextcloud servers followed by credential harvesting, while CVE-2026-114625 exploitation was traced to two IP addresses geolocated to Japan, marking the third VeloCloud vulnerability weaponized since July 2026.

This incident underscores an accelerating pattern of critical infrastructure and SD-WAN orchestration platforms being targeted through high-CVSS injection vulnerabilities. With three VeloCloud flaws actively exploited within a four-month window, attackers are systematically probing network management planes—raising the stakes significantly for organizations relying on these platforms for hybrid and multi-cloud connectivity.

Why This Matters Now

FCEB agencies face a hard remediation deadline of October 26, 2026, and Arista VeloCloud Orchestrator has now accumulated three actively exploited critical CVEs since July 2026. SD-WAN orchestration platforms sit at the center of hybrid cloud connectivity, meaning a successful SQL injection giving privileged access could expose east-west traffic, internal routing policies, and connected cloud workloads to full compromise with minimal attacker footprint.

Attack Path Analysis

Related CVEs

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Both vulnerabilities highlight failures in network segmentation and access control—core requirements under NIST 800-53 SC-7, PCI DSS 4.0, and ZTMM Network controls. Organizations without east-west traffic inspection and zero trust segmentation allowed attackers to escalate privileges and move laterally after initial exploitation.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF is directly relevant to this incident because attackers exploited exposed web-facing services and then moved freely across internal workloads due to absent segmentation and unrestricted egress. By enforcing workload-level segmentation, identity-aware access boundaries, and controlled egress paths, Aviatrix CNSF would likely have reduced the attacker's reachability across Nextcloud and VeloCloud environments and constrained the overall blast radius of both exploitation chains.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Enforcing perimeter-level access policy through the CNSF fabric would likely reduce the reachable attack surface exposed to untrusted external sources, potentially limiting which source IPs or identities could reach the Collabora Online and VeloCloud Orchestrator interfaces in the first place, constraining the initial exploitation window.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero Trust segmentation would likely constrain how far a web shell or SQL-injected session could reach within the environment by scoping workload-to-workload communication to only explicitly permitted identity-verified paths, reducing the operational scope available to an attacker who has gained initial footing on a single host or application tier.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic security enforcement would likely reduce the attacker's ability to pivot freely between internal workloads, constraining lateral movement paths from the compromised Nextcloud hosts toward credential stores and other sensitive internal services that should have no legitimate communication relationship with the web server tier.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Consistent multicloud visibility across both Nextcloud and VeloCloud environments would likely surface anomalous outbound connection patterns from compromised workloads, and centralized policy control could help constrain unauthorized outbound paths before C2 channels become operationally persistent across multiple cloud environments.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress security and policy enforcement would likely constrain unauthorized outbound data transfers from compromised Nextcloud workloads by restricting outbound connections to approved destination FQDNs or IP ranges, reducing the likelihood that credential and wallet artifacts could be silently transmitted to arbitrary external attacker-controlled endpoints.

Impact (Mitigations)

Had earlier segmentation, east-west enforcement, and egress controls been in place, the residual impact would likely have been scoped to fewer compromised workloads, with attacker persistence constrained to the initially exploited host rather than propagating across Nextcloud servers and VeloCloud orchestration infrastructure, reducing the risk of credential-driven downstream account takeovers.

Impact at a Glance

Affected Business Functions

  • Collaborative Document Editing and Cloud Office Services (Nextcloud/Collabora)
  • SD-WAN Network Orchestration and Management (Arista VeloCloud)
  • Credential Store and Authentication Infrastructure
  • Enterprise Network Access Control and Privileged Administration
Operational Disruption

Estimated downtime: 7 days

Financial Impact

Estimated loss: N/A

Data Exposure

For CVE-2026-110447: Threat actors have actively backdoored Nextcloud servers with web shells, enabling persistent access to credential stores, password manager artifacts, and cryptocurrency wallet data belonging to end users and organizations. For CVE-2026-114625: Successful exploitation of the Arista VeloCloud Orchestrator SQL injection enables privilege escalation from read-only enterprise user to privileged internal functionality, potentially exposing SD-WAN network topology configurations, device credentials, administrative accounts, and internal routing policies across all managed enterprise branches. Two attacker-controlled IP addresses geolocated to Japan have been attributed to the VeloCloud campaign. FCEB agencies are at confirmed risk with a remediation deadline of October 26, 2026. Financial loss is not publicly disclosed; however, exposure of network orchestration credentials and credential stores in enterprise environments represents high-value potential for subsequent ransomware deployment, lateral movement, or espionage operations.

Recommended Actions

  • • Deploy Inline IPS (Suricata-based) signatures for CVE-2026-110447 and CVE-2026-114625 exploit patterns across all ingress paths to Collabora Online and VeloCloud Orchestrator web interfaces, blocking known malicious payloads before they reach vulnerable endpoints.
  • • Enforce Zero Trust Segmentation with identity-based microsegmentation policies to isolate Nextcloud and VeloCloud workloads from internal credential stores, password vaults, and lateral service-to-service paths — preventing post-exploitation pivoting even after initial compromise.
  • • Enable Egress Security & Policy Enforcement with FQDN-based outbound filtering and data loss prevention controls on all cloud workloads hosting Collabora and VCO deployments, blocking unauthorized outbound data transfers to attacker-controlled infrastructure.
  • • Activate Multicloud Visibility & Control to baseline normal traffic patterns for Nextcloud and VeloCloud environments, enabling anomaly detection on repeated malformed requests, suspicious automation, and covert C2 channels originating from known attacker IPs such as 74.82.197[.]86 and 38.54.50[.]151.
  • • Apply Cloud Native Security Fabric (CNSF) inline enforcement at the cloud network perimeter to provide real-time inspection and distributed policy control across hybrid and multicloud deployments, ensuring that exploit traffic targeting proxy.php or VCO SQL endpoints is intercepted and blocked before execution reaches vulnerable application logic.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image