Daily brief 2026-10-24: Collabora Collabora Online – Built-in CODE Server and what businesses should patch

CVE-2026-110447 (Collabora Collabora Online – Built-in CODE Server): Collabora Online – Built-in CODE Server OS Command Injection Vulnerability. Severity CRITICAL, CVSS 9.2, EPSS 2.3%, listed in CISA KEV (exploited in the wild).

CVE-2026-114625 (Arista VeloCloud Orchestrator): Arista VeloCloud Orchestrator SQL Injection Vulnerability. Severity CRITICAL, CVSS 9.4, EPSS 0.8%, listed in CISA KEV (exploited in the wild).

CVE-2026-83938 (Unknown ): CVE-2026-83938: Missing authentication for critical function in Azure Kubernetes Configuration Service all…. Severity CRITICAL, CVSS 10, EPSS 0.7%.

CVE-2026-97785 (Unknown ): CVE-2026-97785: Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privil…. Severity CRITICAL, CVSS 10, EPSS 0.6%.

CVE-2026-115806 (Unknown ): CVE-2026-115806: The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object In…. Severity CRITICAL, CVSS 9.8, EPSS 0.8%.

CVE-2022-51026 (Unknown ): CVE-2022-51026: Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows u…. Severity CRITICAL, CVSS 9.3, EPSS 0.6%.

WordPress & websites: CVE-2026-115806. See the Business Apps page for what to ask your provider.

Prioritize anything in CISA KEV and anything internet-facing (VPNs, firewalls, web servers, remote-support tools). Confirm patch status across every client tenant, and kill active sessions after patching gateway appliances.

CVE-2026-110447: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CVE-2026-114625: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CVE-2026-110447 affects Collabora Collabora Online – Built-in CODE Server. Patch the server or plugin, put a web application firewall in front, and review logs for exploitation.

CVE-2026-115806 affects Unknown . Patch the server or plugin, put a web application firewall in front, and review logs for exploitation.

Ask your IT provider which of these products you run, and get written confirmation they are patched or mitigated.

Enforce MFA, keep tested offline backups, and make sure remote access is not exposed without protection.