Two vulnerabilities were added to CISA's Known Exploited Vulnerabilities catalog on October 23, 2026. Both are being exploited, and both have a CISA remediation due date of October 26, 2026.

1. CVE-2026-114625 — Arista VeloCloud Orchestrator

This is a SQL injection flaw in the on-prem Arista VeloCloud Orchestrator. A remote attacker may be able to access privileged internal functionality and impact the host; successful exploitation may compromise the orchestrator and the data it manages.

The action that matters: if your organization runs the on-prem VeloCloud Orchestrator, apply the vendor's mitigations now.

Full entry: https://red-flag-cyber-site.andrewdpeat.workers.dev/vulnerabilities

2. CVE-2026-110447 — Collabora Online – Built-in CODE Server

This is an OS command injection flaw in Collabora Online's Built-in CODE Server when used within the Nextcloud platform. It allows remote code execution when the CODE server isn't running.

The action that matters: if you run Collabora Online inside Nextcloud, apply the vendor's mitigations now.

Full entry: https://red-flag-cyber-site.andrewdpeat.workers.dev/vulnerabilities

Keep affected systems patched, and check the full vulnerability dashboard before you trust a system you rely on: https://red-flag-cyber-site.andrewdpeat.workers.dev/vulnerabilities

— Red Flag Cyber research desk