Attacks on Arista VeloCloud and Collabora/Nextcloud observed
Comments on “Attacks on Arista VeloCloud and Collabora/Nextcloud observed”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
CISA has added two actively exploited flaws to its known-exploited list: a SQL injection in Arista VeloCloud Orchestrator On-Premise, fixed in 5.2.3.18, 6.1.3.10 and 6.4.2.12, and an unauthenticated command injection in the Collabora Online Built-in CODE Server for Nextcloud, fixed in 26.4.303. Disabling the Nextcloud app does not mitigate the Collabora flaw, and the fixed app needs Nextcloud 30 or later. Issue-tracker reports of web shells suggest attacks since mid-September, though that is unverified. Until VCO is patched, restrict access and block the IPs Arista published.
Why it ranked
No. 19 of 124 with a score of 0.68. The panel rated it highest on new information (0.90) and practical relevance (0.83), lowest on audience breadth (0.51).
Every answer behind this is in the table under Score.
Score
0.68total under rubric v2.2
- Significance0.57
- Reader interest0.77
- Audience breadth0.51
- Practical relevance0.83
- Substantiated0.73
- Technical depth0.61
- New information0.90
- Counts against: Promotional0.03
- Counts against: Overclaim0.14
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.55 | 0.45 | 0.72 | 0.57 | 0.27 | +0.24 | +0.138 |
| Reader interest | 0.71 | 0.70 | 0.90 | 0.77 | 0.20 | +0.26 | +0.200 |
| Audience breadth | 0.47 | 0.45 | 0.62 | 0.51 | 0.17 | +0.13 | +0.067 |
| Practical relevance | 0.74 | 0.85 | 0.90 | 0.83 | 0.16 | +0.22 | +0.183 |
| Substantiated | 0.64 | 0.70 | 0.86 | 0.73 | 0.22 | +0.05 | +0.037 |
| Technical depth | 0.74 | 0.45 | 0.63 | 0.61 | 0.29 | +0.05 | +0.030 |
| New information | 0.92 | 0.80 | 0.98 | 0.90 | 0.18 | +0.05 | +0.045 |
| Promotional | 0.04 | 0.03 | 0.02 | 0.03 | 0.02 | −0.19 | −0.006 |
| Overclaim | 0.23 | 0.15 | 0.04 | 0.14 | 0.19 | −0.11 | −0.015 |
| Sum of contributions | +0.678 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.678 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-27/19/"><img src="https://rubric.hrih.si/badge/2026-10-27/19.svg" alt="Ranked #19 on Rubric, 27 Oct 2026" width="245" height="28"></a>Claim check
Claim check: 4 matches source · 1 no source given · 3 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Matches sourceCausal conclusion
Attackers are already exploiting a SQL injection vulnerability in Arista VeloCloud Orchestrator (VCO) On-Premise over the internet, according to CISA.
The cited source says the same thing.
The article says “attackers are already exploiting a SQL injection vulnerability in Arista VeloCloud Orchestrator (VCO) On-Premise over the internet”
The source says “CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation”
Source cited by the article: cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog
Couldn’t checkNumber
The Arista VCO vulnerability is tracked as CVE-2026-114625 with a CVSS4 score of 9.4, rated critical.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “CVE-2026-114625, CVSS4 9.4, risk “critical”
The source says No passage could be compared.
Source cited by the article: cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog
Matches sourceVersion
Arista identifies VCO versions 5.2.3.18, 6.1.3.10 and 6.4.2.12 as fixed.
The cited source says the same thing.
The article says “identifies versions 5.2.3.18, 6.1.3.10 and 6.4.2.12 of VCO as fixed”
The source says “VCO 5.2.3.18 and later in the 5.2 train - VCO 6.1.3.10 and later in the 6.1 train - VCO 6.4.2.12 and later in the 6.4 train”
Source cited by the article: arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199
Matches sourceNumber
Arista listed attacker IP addresses 74.82.197.86 and 38.54.50.151 as indicators of compromise.
The cited source says the same thing.
The article says “These include the attacker IP addresses 74.82.197.86 and 38.54.50.151”
The source says “The following IP addresses have been observed conducting the attacks. It is advised to block these IPs and review logs to see if they are present”
Source cited by the article: arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199
Couldn’t checkNumber
The Collabora Online Built-in CODE Server flaw allows unauthenticated OS command injection, only while the CODE Server is not running, and is tracked as CVE-2026-110447 with CVSS4 9.2.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “attacks work only while the Built-in CODE Server is not running — during a container restart or upgrade, or after a crash (CVE-2026-110447, CVSS4 9.2, risk “critical”
The source says No passage could be compared.
Source cited by the article: cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog-0
Matches sourceVersion
Disabling the app in Nextcloud does not protect against the flaw; only updating to fixed version 26.4.303 or later helps.
The cited source says the same thing.
The article says “Disabling the app in Nextcloud does not protect against the flaw; only an update to fixed version 26.4.303 or later will help”
The source says “It is not sufficient to disable the app to avoid the problem, it must be upgraded to >= 26.4.303 or removed”
Source cited by the article: github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh
Couldn’t checkDate
The first entries in the Collabora Online issue tracker date back to Sept. 11, with affected users reporting web shells installed via richdocumentscode.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “The first entries in the Collabora Online issue tracker date back to Sept. 11 of this year”
The source says No passage could be compared.
Source cited by the article: github.com/CollaboraOnline/richdocumentscode/issues/354
No source givenCausal conclusion
The attacks on Collabora/Nextcloud have been underway since at least Sept. 11.
The article gives no link or citation for it.
The article says “The attacks have therefore been underway since at least then”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN —
Recorded for context only, checked 27 Oct 2026, 05:46 UTC. It played no part in the ranking.