Search — “CVE-2026-114625”

An Eclypsium InfraTrust Pulse report (covering September 18 to October 14) lists actively exploited vulnerabilities across network appliances and warns that PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) affect PHP embedded in appliance management interfaces. Because vendors compile PHP into firmware, customers must wait for vendor firmware updates. InfraTrust recommends keeping PHP-backed management interfaces off the Internet until patches arrive; the sources do not describe confirmed PHP2Shell exploitation in the wild.

CISA added Arista VeloCloud Orchestrator on-prem CVE-2026-114625, a SQL injection allowing a remote attacker to reach privileged internal functionality, to the KEV catalog on 2026-10-23 with a 2026-10-26 due date. CISA also added Collabora Online built-in CODE Server CVE-2026-110447, an OS command injection used with Nextcloud that allows remote code execution when the CODE server is not running, on the same date. The sources provided do not describe observed attack behavior, payloads, or indicators for either flaw, so hunt guidance is limited to patching and exposure review.

Arista disclosed CVE-2026-114625 (CVSS 9.9), a remotely exploitable SQL injection in on-premises VeloCloud Orchestrator (VCO) that is known to be actively exploited. Per the vendor, any authenticated user with the lowest built-in tenant role can gain operator privileges and masquerade as a local superuser operator. Hunters should review VCO web access logs for requests from 74.82.197.86 and 38.54.50.151, look for high request rates and URL-like path components, encoded characters, and references to local or internal services, and watch for backdoor daemons and webshells.