KEV due Oct 26: Nextcloud built-in Collabora CODE and Arista VCO, patch and check for compromise

Checklist for the two exploited bugs CISA added on Oct 23 with a three-day deadline and forensic triage. Built from the Collabora and Arista advisories and the KEV entries.

For: Security lead, Nextcloud admin, Network / SD-WAN admin, SOC

1. Find what you run 2. Patch 3. Check for compromise before and after patching 4. Contain if you can't patch today

Step 1 of 4
Find what you run
Both bugs only affect specific deployments.
- Nextcloud: run `occ app:list | grep richdocumentscode`; standalone Collabora Online servers are not affected
- Arista: list on-prem VeloCloud Orchestrator instances and versions; hosted and dedicated VCO are already patched
Step 2 of 4
Patch
Use the vendor fixes.
- Upgrade richdocumentscode to 26.4.303 or later, or remove the app (disabling is not enough)
- Upgrade VCO to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later; contact Arista TAC for end-of-support trains
- On EOL Nextcloud 29 or older, upgrade Nextcloud or remove the app
Step 3 of 4
Check for compromise before and after patching
CISA flagged both for forensic triage; patching won't remove a backdoor.
- Nextcloud: look for unexpected PHP files under apps/richdocumentscode/ and new web-user cron jobs or processes
- VCO: search web logs for 74.82.197.86 and 38.54.50.151, unusual URL-like path components, encoded characters and references to internal services
- Preserve web, application, system and database logs plus file timestamps before cleanup
Step 4 of 4
Contain if you can't patch today
Stopgaps only.
- Restrict the VCO web UI to admin networks and block outbound ports from the VCO host
- Remove richdocumentscode and use a separate Collabora server
- Rotate secrets the web user or VCO operator account could read if you find any sign of access

Original content by ctxsec. Printable checklist: use your browser's print view.