Arista says CVE-2026-114625 is being actively exploited in VeloCloud Orchestrator. For an administrator deciding whether to interrupt a running system, the first question is which deployment and release the organisation has. Hosted services, including dedicated instances, have already been patched, according to Arista. [1]

The affected on-premises release trains are 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, and 6.4.x before 6.4.2.12. Those three versions contain the fixes. Arista has not assessed releases that are out of support. VeloCloud Gateway and Edge are not affected by this flaw. [1]

An attacker needs access to the Orchestrator web interface and a valid session; even an Enterprise Read Only account is sufficient. Arista recommends upgrading, restricting administrative access while the fix is pending, and reviewing logs. If compromise is suspected, preserve the logs before remediation where feasible. [1]

Collabora’s separate CVE-2026-110447 affects the richdocumentscode built-in CODE Server app for Nextcloud before version 26.4.303. The vendor says to upgrade to that version or later, or remove the app. Disabling it is insufficient. The vulnerable path operates while the built-in server is not running; standalone Collabora Online servers are unaffected. Users on end-of-life Nextcloud versions 29 or earlier should upgrade Nextcloud or remove the app. [2]

These distinctions change the change ticket. A VeloCloud Edge appliance and a standalone Collabora server do not belong in the same queue as the affected deployments. Identify the exposed system, then attach the relevant fixed release and the investigation steps to its owner’s ticket.