CISA added two already-exploited bugs to its Known Exploited Vulnerabilities catalog on Oct 23, both with a federal due date of Oct 26 and both flagged for CISA's forensic triage requirement, meaning agencies must check for compromise, not just patch.

• CVE-2026-110447, Collabora Online Built-in CODE Server (Nextcloud app richdocumentscode): unauthenticated OS command injection in proxy.php that works while the bundled CODE server is not running. Fix: richdocumentscode 26.4.303 or later, or remove the app; Collabora says disabling it is not enough. Exploitation dates back to September, and admins have reported webshells. Standalone Collabora Online servers are not affected.
• CVE-2026-114625, Arista VeloCloud Orchestrator (on-prem): SQL injection (CVSS 9.9) that lets any authenticated user, down to the lowest tenant role, act as the local superuser operator. Fixed in 5.2.3.18, 6.1.3.10 and 6.4.2.12; hosted VCO is already patched. Arista has seen attacks from 74.82.197.86 and 38.54.50.151. It is the third exploited VCO zero-day in four months.

Ransomware use is listed as unknown for both. If you run either, patch today, then look for webshells or new operator activity, because patching does not remove a backdoor that is already in place.