Security Advisory

This Week's Top 3: A Critical SD-WAN Orchestrator Flaw Under Attack, a Nextcloud Webshell Campaign, and the Plex2Shell Exploit Chain

Published October 25, 2026 · Cyber One Solutions

CISA added eight vulnerabilities to its Known Exploited Vulnerabilities catalog this week, and three reach systems many commercial businesses actually run: an Arista VeloCloud SD-WAN orchestrator flaw with no configuration workaround, a webshell campaign against self-hosted Nextcloud document servers, and a four-vulnerability Plex Media Server chain a honeypot caught attackers weaponizing within a day of disclosure. Here are the three verified developments for small and mid-size businesses this week, ranked by relevance, exploitation evidence, and urgency.

This brief covers verified security and compliance developments from Sunday, October 18 through Saturday, October 24, 2026, with a research cutoff of Sunday, October 25, 2026 at 6:00 a.m. Central. It is the edition for the regular Sunday, October 25 slot. It was a quieter week on CISA's Known Exploited Vulnerabilities (KEV) catalog than the one before it: eight vulnerabilities were added across five vendors, and three of them stood out for how directly they reach the systems a commercial business depends on day to day, rather than a narrow device category most businesses never touch.

Executive Summary and Priorities

Three verified developments met our bar for inclusion this week:

Arista VeloCloud Orchestrator:: a SQL injection flaw, CVE-2026-114625, that Arista itself confirmed is being actively exploited against on-premises SD-WAN orchestration appliances, with no configuration workaround available.
Collabora Online's Built-in CODE Server:: an OS command injection flaw, CVE-2026-110447, in the Nextcloud app that runs Collabora's document editor, exploited since mid-September to plant webshells on self-hosted Nextcloud servers.
Plex Media Server:: a four-vulnerability exploit chain nicknamed "Plex2Shell" that a security researcher's own honeypot caught attackers weaponizing within a day of public disclosure, planting cryptomining malware on exposed servers.

Two additional vulnerabilities were added to the KEV catalog this week but not ranked, covered briefly below.

How We Ranked This Week's Developments

We ranked these three by how many of the businesses we serve are likely to run the affected technology, the strength and source of the exploitation evidence (a vendor's own confirmation carries more weight here than a researcher's honeypot, though both meet CISA's bar for the KEV catalog), how directly the affected system sits in the path of business operations, and whether any interim mitigation exists short of patching.

Arista ranks first because the vendor itself confirmed active exploitation of a flaw with no workaround at all, in software that manages business-grade wide-area networking across every site a company's SD-WAN connects, and because the privilege required to exploit it is the lowest read-only role in the system. Collabora ranks second: the exploitation is also confirmed, through a maintainer-tracked GitHub thread describing an active webshell campaign, and the fix had already been available for well over a month before this brief, but it needs one scoping note: "CODE" is Collabora's own name for this free build (Collabora Online Development Edition), not a special Nextcloud test channel, so any stable Nextcloud installation running the Built-in CODE Server app is in scope, not only installations on some kind of "development" footing. Plex ranks third because, while the honeypot evidence of real cryptomining exploitation is solid and specific, the affected software is a media server, not a line-of-business system; the lesson here is about exposure hygiene more than about a system a business cannot do without. These rankings are editorial judgments, not a measured risk score.

1. A SQL Injection Flaw in Arista's VeloCloud SD-WAN Orchestrator, Actively Exploited With No Workaround

Arista Networks disclosed on October 22, 2026 that CVE-2026-114625, a SQL injection flaw in on-premises VeloCloud Orchestrator (VCO), "is known to be actively exploited," and published two attacker source IP addresses its own monitoring observed. CISA added the flaw to its KEV catalog the next day, October 23, with an October 26 remediation due date. Arista's PSIRT rates the flaw 9.9 under CVSS v3.1 and 9.4 under CVSS v4.0. VeloCloud Orchestrator is the management and policy-control layer behind Arista's SD-WAN platform (the software, formerly sold under the Broadcom/VMware VeloCloud name, that many managed network providers use to centrally configure and monitor a business's wide-area network across every connected site).

What makes this flaw unusual is the combination of low privilege and high impact: any authenticated user, even one holding only the lowest "Enterprise Read Only" tenant role, can use the SQL injection to gain operator-level privileges and impersonate a local "superuser operator," reaching internal functionality that was never meant to be remotely accessible. Arista's advisory is explicit that "there is no configuration that can prevent the exposure," meaning the only real fix is the patched version itself: 5.2.3.18 or later, 6.1.3.10 or later, or 6.4.2.12 or later, depending on which branch an organization runs. VCO's cloud-hosted and dedicated-hosted editions were also affected but Arista had already patched those before disclosure.

If your business's internet connectivity is managed through an SD-WAN platform, whether by an internal network team or by a managed service provider, this week's action is to confirm with whoever operates that platform whether it is VeloCloud Orchestrator, and if so, that it has already moved to a fixed version. Because there is no workaround, waiting is not a reasonable interim posture here. Until patched, Arista recommends restricting VCO's web interface to trusted admin networks, blocking the two IP addresses it published (74.82.197.86 and 38.54.50.151), and reviewing access logs for unusual URL-encoded paths or unexplained spikes in outbound traffic from the orchestrator host, since that combination is what an undetected compromise would look like. For a business that does not operate its own SD-WAN orchestrator at all, this is also a good prompt to ask your provider the same question about whatever platform they do use.

2. A Webshell Campaign Against Self-Hosted Nextcloud Servers Running Collabora's Built-in Document Editor

CVE-2026-110447, an OS command injection flaw in the richdocumentscode app that powers Collabora Online's built-in CODE server for Nextcloud, was added to CISA's KEV catalog on October 23, with an October 26 due date. The flaw itself was published October 14, rated 9.2 (Critical) under CVSS v4.0, but a maintainer-tracked GitHub issue on the richdocumentscode project describes an active exploitation campaign that multiple Nextcloud administrators reported independently: attackers sending path-traversal and base64-encoded shell commands to the app's proxy.php endpoint, which drops PHP webshells (file names following the pattern shx*.php) that then run arbitrary commands as the web server's own user. The same thread notes attackers searching compromised servers for credential files and cryptocurrency wallets once inside, which points to opportunistic follow-on theft rather than a one-step smash-and-grab.

The flaw has a scope that is easy to misread: "CODE" stands for Collabora Online Development Edition, which is Collabora's own name for the free build of its office-document editor, not a special test or beta channel of Nextcloud itself. Any ordinary, stable Nextcloud installation that added the free Built-in CODE Server app (the richdocumentscode app, which downloads and runs a local copy of Collabora's editor) rather than paying for a standalone Collabora Online server is in scope, which is a common way smaller self-hosted deployments add office-document editing without a separate license. The flaw triggers only when that built-in server process is not currently running, for instance right after a restart, upgrade, or crash, which is a common enough moment that it has not meaningfully slowed exploitation. The fix is to update the richdocumentscode app to version 26.4.303 or later; a Collabora maintainer confirmed that version resolved the issue as early as September 14, 2026, over a month before the CVE and the KEV listing, though the GitHub issue tracking it was not formally closed until October 14, when the advisory was published. The GitHub thread does not describe a reliable interim workaround short of disabling or removing the app entirely; one administrator reported that disabling it did not stop requests from still reaching proxy.php, a detail that went unanswered in the thread, so treat "disabled" as unconfirmed protection rather than a real mitigation.

Businesses that chose a self-hosted platform like Nextcloud specifically to keep documents off a third-party cloud, often for data-residency or compliance reasons, should treat this as a direct hit on that choice's upkeep burden: self-hosting shifts the patching responsibility onto you or your IT provider, and a flaw like this one shows what happens when that responsibility lapses even briefly. If your organization or IT provider runs Nextcloud with the built-in Collabora editor, confirm the richdocumentscode version is 26.4.303 or later now, and search the apps/richdocumentscode/ directory for any file matching shx*.php that you did not put there yourself.

3. The "Plex2Shell" Exploit Chain: Four Plex Media Server Flaws, Weaponized Within a Day of Disclosure

CISA added four Plex Media Server vulnerabilities to its KEV catalog on October 20: CVE-2026-96652 and CVE-2026-96655 (both server-side request forgery flaws, due November 3) and CVE-2026-96654 and CVE-2026-96656 (an encoded-URI handling flaw and a file-write flaw, both due October 23). Chained together in sequence, independent researcher Zach Main's write-up shows how the four achieve full, unauthenticated remote code execution: an unauthenticated request forges a connection to the server's own loopback interface; a second flaw abuses that trusted loopback path to call internal plugin functions; a third tricks the server into attaching its own administrator token to a request aimed at an attacker-controlled address disguised as a loopback hostname; and the fourth uses that stolen admin token to make the video transcoder write an attacker-supplied file to disk, where the server's codec loader runs it with no signature or permission check at startup. The researcher reported the chain to Plex on July 27, 2026 under its bug-bounty program; Plex shipped a fix in version 1.43.3.10861, and the researcher published full technical details on October 16.

The gap between disclosure and real-world attack was short. A separate researcher who runs a public Plex honeypot (an intentionally exposed, monitored decoy server) reported that after a period of only generic scanning, "as of this morning (Oct 17th), I finally saw in the wild exploitation," one day after the public write-up. The attacker downloaded a file from a server at 217.60.194.116 that turned out to be an XMRig cryptocurrency miner, alongside a second program labeled "myawesomeproxy" that repurposes the compromised server's internet connection for proxy traffic; the honeypot operator published the exploit request's signature (a plain "Python-urllib/3.10" client calling the server's /player/timeline/subscribe endpoint) along with several attacker IP addresses and file hashes for anyone who wants to check their own logs.

Plex Media Server is not the system most businesses build their operations around, but plenty of businesses run a copy of it somewhere: on an office NAS for an employee break room, behind a digital signage setup, or on a server someone set up years ago and nobody has thought about since. That is exactly the profile this kind of exploitation targets. Updating is not the same as recovering: Plex's own October 19 security update says any server older than 1.43.3.10861 that was reachable from the internet should be treated as possibly already compromised, and recommends checking for unrecognized processes started by Plex Media Server itself, such as a cryptominer or proxy program, inspecting the Codecs folder for unfamiliar files, and rebuilding the server from a clean installation rather than reusing the old data directory if compromise cannot be ruled out, alongside signing out every device from the Plex account and changing its password. If your business has a Plex server anywhere on its network, confirm it is on version 1.43.3.10861 or later, work through that compromise check if it was ever internet-reachable on an older version, and ask whether it genuinely needs to be reachable from the internet at all; a media server with no business function and an open port to the public internet is the easiest kind of finding for an attacker's automated scanning to turn into cryptomining revenue, and the same exposure habit that lets this happen is worth checking for in anything else non-essential your business has quietly left open.

Also Added to the KEV Catalog This Week

CISA also added two vulnerabilities we did not rank. CVE-2026-106931, an OS command injection flaw in EG Secure Solutions' SiteGuard Server Edition, was added October 20 with an October 23 due date; it can let an attacker run commands with root or SYSTEM privileges, but SiteGuard is a web application firewall product used almost exclusively in the Japanese market, so we judged it to have limited relevance to the businesses we serve. CVE-2026-110936, an uncontrolled search path (DLL side-loading) flaw in Siemens Software Center, was also added October 20, with a November 3 due date. We did not rank it despite active exploitation because the vulnerability itself needs an attacker who already has local access to the machine; but Siemens' own October 19 campaign report describes a different, broader risk worth a direct warning regardless: attackers running what Siemens calls a "Romulus" ClickFix campaign (tricking a user into pasting a malicious command into the Windows Run box or PowerShell) are distributing a genuine, unmodified Siemens Software Center executable bundled with their own malicious DLLs, which can land on a PC that never had Siemens Software Center installed at all. The warning sign Siemens names is Siemens Software Center appearing in a PC's startup apps or Task Scheduler despite nobody installing it. If your business operates in manufacturing and already uses Siemens Software Center, update to version 4.0.9.8 or later and only install Siemens software from official sources; whether or not you use Siemens products, never paste a command from a web page into the Run box or PowerShell, which is the delivery method Siemens describes for this campaign.

Do Now

If your SD-WAN or wide-area network is managed through Arista VeloCloud Orchestrator, on-prem, confirm with your network team or provider that it is already on a patched branch (5.2.3.18, 6.1.3.10, or 6.4.2.12, or later); there is no configuration-based mitigation, so patching is the only real fix.
If your business or IT provider runs Nextcloud with the built-in Collabora CODE server, confirm the richdocumentscode app is at version 26.4.303 or later, and check the apps/richdocumentscode/ directory for any unexpected shx*.php files.
Find out whether a Plex Media Server exists anywhere on your network, confirm it is updated to 1.43.3.10861 or later, work through Plex's own compromise check (unrecognized processes, an unfamiliar Codecs folder, a clean rebuild if compromise cannot be ruled out) if it was ever internet-reachable on an older version, and if it has no real business purpose or does not need internet access, remove that exposure rather than just patching it.

Plan Next

Ask whoever manages your wide-area network, whether in-house or an MSP, what SD-WAN or network-orchestration platform they use and how quickly they patch it when a critical flaw surfaces with no interim workaround.
If your business depends on a self-hosted platform for data residency or compliance reasons, confirm who specifically owns patching it on an ongoing basis, since that responsibility does not come for free with the choice to self-host.
Do a quick internal inventory of "convenience" software, media servers, file-sharing tools, old demo instances, that may still be running and reachable from the internet without anyone currently owning its upkeep.

Watch List

Whether Arista or CISA report exploitation of CVE-2026-114625 beyond the two attacker IP addresses already published.
Whether further compromises tied to the Collabora/Nextcloud webshell campaign surface outside the Built-in CODE Server (richdocumentscode) scope described so far.
Whether Plex2Shell exploitation moves past cryptomining toward more damaging payloads now that the full exploit chain is public.

The Bottom Line

Two of this week's three developments share a throughline that is easy to miss: both hit software a business chose to run and manage itself, a network orchestration platform and a self-hosted document editor, rather than something handled entirely by a cloud vendor. That choice carries real benefits, but it also carries the patching obligation that comes with it, and this week shows what happens when that obligation lapses, even briefly. This brief is general security awareness, not a HIPAA, FTC Safeguards, or cyber-insurance compliance service. Cyber One Solutions keeps self-managed network and server infrastructure patched and watched through managed cybersecurity, and designs and supports business SD-WAN and internet connectivity through managed internet and networking services. If you are not sure where to start, our free cybersecurity risk score self-assessment is a quick way to see which of this week's gaps may apply to you.