---
title: KEV due Oct 26: Nextcloud built-in Collabora CODE and Arista VCO, patch and check for compromise | ctxsec
url: https://ctxsec.com/playbooks/kev-oct-26-collabora-code-arista-vco
---

[← Playbooks](/playbooks)

# KEV due Oct 26: Nextcloud built-in Collabora CODE and Arista VCO, patch and check for compromise

Checklist for the two exploited bugs CISA added on Oct 23 with a three-day deadline and forensic triage. Built from the Collabora and Arista advisories and the KEV entries.

For: Security lead, Nextcloud admin, Network / SD-WAN admin, SOC

[1. Find what you run](#s1)[2. Patch](#s2)[3. Check for compromise before and after patching](#s3)[4. Contain if you can't patch today](#s4)

1.

Step 1 of 4

__

### Find what you run

Both bugs only affect specific deployments.

   - Nextcloud: run `occ app:list | grep richdocumentscode`; standalone Collabora Online servers are not affected
   - Arista: list on-prem VeloCloud Orchestrator instances and versions; hosted and dedicated VCO are already patched

2.

Step 2 of 4

__

### Patch

Use the vendor fixes.

   - Upgrade richdocumentscode to 26.4.303 or later, or remove the app (disabling is not enough)
   - Upgrade VCO to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later; contact Arista TAC for end-of-support trains
   - On EOL Nextcloud 29 or older, upgrade Nextcloud or remove the app

3.

Step 3 of 4

__

### Check for compromise before and after patching

CISA flagged both for forensic triage; patching won't remove a backdoor.

   - Nextcloud: look for unexpected PHP files under apps/richdocumentscode/ and new web-user cron jobs or processes
   - VCO: search web logs for 74.82.197.86 and 38.54.50.151, unusual URL-like path components, encoded characters and references to internal services
   - Preserve web, application, system and database logs plus file timestamps before cleanup

4.

Step 4 of 4

__

### Contain if you can't patch today

Stopgaps only.

   - Restrict the VCO web UI to admin networks and block outbound ports from the VCO host
   - Remove richdocumentscode and use a separate Collabora server
   - Rotate secrets the web user or VCO operator account could read if you find any sign of access

Original content by ctxsec. Printable checklist: use your browser's print view.