This edition combines the weekend’s developments with today’s. Top of the list is the actively exploited SQL injection flaw in Arista VeloCloud Orchestrator, followed by web shells planted via Collabora Online in Nextcloud. In addition, the actor k0t is hijacking Fortinet and Palo Alto firewalls and VPN gateways, GitLab fixes a flaw rated CVSS 10.0, and a researcher demonstrates a root escalation in Tailscale SSH for which no patch yet exists.
- Arista VeloCloud Orchestrator actively exploited: CVSS 9.9 SQL injection in the SD-WAN management platform
- Collabora Online in Nextcloud exploited for web shells: critical flaw in the built-in CODE server
- Attacker k0t hijacks firewalls and VPN gateways: more than 70,000 FortiGate and GlobalProtect credentials exposed
- GitLab fixes critical CVSS 10.0 flaw: unknown attacker can execute code on self-managed servers without logging in
- Tailworm: researcher demonstrates root escalation via Tailscale SSH, no patch or CVE yet
Arista VeloCloud Orchestrator actively exploited: CVSS 9.9 SQL injection in the SD-WAN management platform
| Vulnerability | SQL injection in on-premise Arista VeloCloud Orchestrator (VCO), the management platform for VeloCloud SD-WAN. An attacker gains access to privileged internal functions. On-premise versions of VCO prior to the patched releases are affected |
| CVE number | CVE-2026-114625 |
| CVSS score | 9.9 |
| Actively exploited | Yes, Arista reports active exploitation and CISA added the vulnerability to the KEV catalogue on 23 October 2026 |
| Patch available | Yes, in October 2026: versions 5.2.3.18, 6.1.3.10 and 6.4.2.12 |
How can the vulnerability be exploited?
According to The Hacker News, an attacker needs network access to the VCO web interface, plus a valid authenticated session. The lowest role that suffices is Enterprise Read Only. In other words, a minor role is enough to reach privileged functions. Arista is not sharing technical details and has not named a perpetrator. It has, however, published two IP addresses from which the activity originates, both geolocated in Japan: 74.82.197.86 and 38.54.50.151.
What could the impact be?
An orchestrator controls the SD-WAN configuration of all connected customer sites. With control over the orchestrator, an attacker can modify routing and policies. It is also the third VCO vulnerability to be exploited in the wild since July 2026, following two earlier flaws rated CVSS 10.0. See also the alert from CISA.
What should IT administrators do now?
Update on-premise VCO to 5.2.3.18, 6.1.3.10 or 6.4.2.12. Do not expose the web interface to the internet and restrict access to management networks. Search logs for traffic from the two IP addresses mentioned and check accounts with the Enterprise Read Only role for unexpected use.
Collabora Online in Nextcloud exploited for web shells: critical flaw in the built-in CODE server
| Vulnerability | OS command injection in the built-in CODE server (richdocumentscode) of Collabora Online, used within Nextcloud. Code execution via proxy.php, only when the local CODE document server is not running |
| CVE number | CVE-2026-110447 |
| CVSS score | 9.2 |
| Actively exploited | Yes, CISA added the flaw to the KEV catalogue on 23 October 2026 |
| Patch available | Yes, version 26.4.303 from September 2026 |
How has this been exploited?
The Hacker News reports that attackers are using the flaw to plant web shells on Nextcloud servers. They then search for stored credentials, traces of password managers and crypto wallets.
What could the impact be?
A web shell gives the attacker persistent access to the server running Nextcloud. For MSPs hosting Nextcloud environments for customers, that means access to files and potentially to other systems on the same network.
What should IT administrators do now?
Update the Collabora app (richdocumentscode) to 26.4.303 or later, including on environments that have not been touched for months. Check the webroot for unknown files, particularly around proxy.php, and search logs for suspicious requests. If you find a web shell, assume the server has been fully compromised and rotate stored credentials.
Attacker k0t hijacks firewalls and VPN gateways: more than 70,000 FortiGate and GlobalProtect credentials exposed
| Vulnerability | Campaign targeting internet-facing network equipment, primarily Fortinet FortiGate and Palo Alto Networks GlobalProtect. The attacker uses known vulnerabilities in FortiWeb and PAN-OS/Prisma Access as well as brute force with commonly used passwords |
| CVE number | CVE-2025-64446 (FortiWeb, path traversal) and CVE-2026-0257 (PAN-OS and Prisma Access, authentication bypass) |
| Actively exploited | Yes, according to Group-IB and NyxLab; most intrusions took place between February and June 2026 |
| Patch available | Yes for the CVEs listed: install the vendor’s latest firmware. For brute force, use a strong password and MFA |
How has this been exploited?
In a joint investigation, researchers from Group-IB and NyxLab describe how the actor ‘k0t’ found devices using scanning tools such as FOFA and ZoomEye, got in via the flaws mentioned or weak passwords, and then set up an OpenConnect VPN connection. Inside the network, this was followed by Active Directory reconnaissance and theft of additional credentials using tools including Mimikatz and Impacket. For persistence, the attacker used legitimate management tools such as MeshCentral, Atera and AnyDesk, and data was exfiltrated via Rclone to Wasabi and MEGA.
What could the impact be?
More than 70,000 network device credentials and LDAP dumps have been exposed. According to the research, k0t is probably closely linked to the ransomware groups Qilin and The Gentlemen, as an initial access broker or affiliate. Around 15.8 per cent of victims are in Europe. Because these are well-known RMM tools, the persistence barely stands out in logs.
What should IT administrators do now?
Patch FortiWeb, PAN-OS and Prisma Access, remove management interfaces from the internet and enforce MFA on VPN. Rotate passwords that have been used via LDAP or the firewall. Also take stock of which remote access tools (MeshCentral, Atera, AnyDesk) are supposed to be present in customer environments and investigate anything beyond that.
GitLab fixes critical CVSS 10.0 flaw: unknown attacker can execute code on self-managed servers without logging in
| Vulnerability | Integer overflow in the Onigmo regular expression engine bundled with GitLab. A specially crafted regular expression can lead to unauthenticated code execution on self-managed GitLab, from version 7.0 up to the patched releases |
| CVE number | CVE-2026-110264 |
| CVSS score | 10.0 |
| Actively exploited | No, GitLab has seen no exploitation and the flaw was not in the KEV catalogue as of 22 October 2026 |
| Patch available | Yes, including 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 |
How can the vulnerability be exploited?
According to The Hacker News, GitLab has not disclosed the conditions for exploitation. The flaw was reported by a researcher going by the name ‘joaxcar’, the same person who found four flaws in the regex engine within a single month. GitLab.com is already running a patched version, so the risk lies with self-managed installations.
What could the impact be?
A GitLab server often holds source code, CI/CD secrets and customer access keys. Unauthenticated code execution could therefore be a stepping stone to other systems. Note: environments patched on 12 October (19.2 and later) are vulnerable again until they have been updated to the new versions.
What should IT administrators do now?
Upgrade to the patched version of your release line. GitLab offers no workaround, so updating is the only reliable measure. Expect downtime on single-node servers, as 19.4.3 and 19.3.6 contain database changes. GitLab has published two Sigma detection rules (‘Onigmo native worker crash’ and ‘Org mode render error burst’) for searching logs for exploitation attempts.
Tailworm: researcher demonstrates root escalation via Tailscale SSH, no patch or CVE yet
| Vulnerability | Series of 11 findings in Tailscale and headscale, including escalation to root via Tailscale SSH with port forwarding. Tested on Tailscale 1.104.2 and headscale 0.29.5 in a lab |
| CVE number | No CVE assigned |
| Actively exploited | No, there is only a lab demonstration from 25 October 2026; the proof of concept has not been made public |
| Patch available | No, Tailscale has not yet issued a bulletin or fixed version. Configuration measures are available, however |
How can the vulnerability be exploited?
In her report, summarised by The Hacker News, researcher Erica Windisch of Cyberdione Labs explains that an attacker must already control an authorised device on the network and that Tailscale SSH must allow port forwarding. Via a socket intended only for root, she obtained root access on the target system. Without Tailnet Lock, she was also able to grab an enrolment key through a race condition and add her own machine as a trusted device.
What could the impact be?
In the lab, a single hijacked device was able to spread rapidly to every device permitted by the access rules. Windisch calls this ‘wormable’, a claim others question. Tailscale has not yet confirmed the technical claims; VP of Engineering Mike Shaver said the company is investigating the same areas and has found issues that it is fixing. The research has not yet been independently reproduced, and the disclosure was ‘reported but not coordinated’.
What should IT administrators do now?
Write SSH rules as one source to one destination and remove broad rules based on identity or tags. Disable SSH port forwarding where possible. On headscale 0.29.5 this is not possible, so treat every SSH grant there as root on the target system. Enable node key expiry, switch on Tailnet Lock and remove a compromised device in the control plane, as simply reinstalling does not revoke copied keys.
This article was originally published in Dutch on MSP Business. Read the original →
