Two New KEV Adds: Arista VeloCloud and Collabora Online

Two fresh CISA KEV additions on October 23

CISA added two actively exploited vulnerabilities to the Known Exploited Vulnerabilities catalog on October 23. The one that should move to the top of your list is CVE-2026-114625, a SQL injection flaw in Arista VeloCloud Orchestrator that carries a CVSS of 9.9. SecurityWeek reports this is the third VeloCloud Orchestrator zero-day exploited in four months, so if you run VCO this is a pattern, not a one-off.

The second addition is CVE-2026-110447, an OS command injection vulnerability in Collabora Online's built-in CODE Server. Both landed in KEV the same day, which means CISA has evidence of active exploitation for both. KEV listing is the line between patch eventually and patch now, so treat these as now.

The hot movers: ransomware-linked and KEV-listed

Beyond the new additions, several KEV-listed criticals are seeing heavy attention and are flagged as ransomware-linked. These are the ones worth checking exposure on if any apply to you:

• CVE-2025-55182, Meta React Server Components remote code execution, CVSS 10, KEV and ransomware-linked, EPSS 0.998
• CVE-2026-41940, WebPros cPanel and WHM missing authentication, CVSS 9.8, KEV and ransomware-linked, EPSS 0.9853
• CVE-2026-0257, Palo Alto Networks PAN-OS authentication bypass, CVSS 9.1, KEV and ransomware-linked, EPSS 0.9689
• CVE-2026-35273, Oracle PeopleSoft PeopleTools missing authentication, CVSS 9.8, KEV and ransomware-linked, EPSS 0.9668
• CVE-2026-63077, JetBrains TeamCity deserialization, CVSS 9.8, KEV and ransomware-linked
• CVE-2026-102764, BeyondTrust Remote Support, CVSS 9.8, KEV listed

PHP emergency release draws the crowd

Two PHP php2shell flaws, CVE-2026-109618 and CVE-2026-109619, both unauthenticated remote code execution at CVSS 9.8, prompted an emergency release on October 21. CERT-EU issued advisory 2026-018 covering them, and they are the top two items on Hacker News with over 1,300 and 1,100 points respectively. Neither is in KEV yet, but with emergency-release RCE and this much public interest, assume exploitation attempts will follow. If you run PHP, apply the emergency release now.

What the press adds

Help Net Security reports Microsoft 365 accounts were compromised at 79 organizations with no passwords needed, using stolen sessions. Separately, Cyber Security News reports China-linked actors used ARTEX AI to target 2,250 Microsoft 365 tenants following the ConnectWise breach. If you run Entra ID, this is a reminder that session token theft bypasses password controls entirely, so conditional access, token protection, and sign-in log review matter.

On the vulnerability side, Cisco Expressway has a critical RCE (CVE-2026-76466), Oracle issued an emergency Java update for an HTTPS trust flaw (CVE-2026-91403), and Citrix NetScaler is being actively exploited to deploy web shells (CVE-2026-88771). Siemens Software Center is also under active exploitation in ClickFix malware campaigns (CVE-2026-110936). Microsoft also confirmed Windows Server 2016 reaches end of support in January, so start planning migrations now.

Do this first

Prioritize by exploitation evidence, then by what you actually run.

• Patch CVE-2026-114625 on Arista VeloCloud Orchestrator and CVE-2026-110447 on Collabora Online CODE Server; both are new KEV adds with active exploitation.
• Apply the PHP emergency release for CVE-2026-109618 and CVE-2026-109619.
• Work the ransomware-linked KEV list above, starting with anything internet-facing: PAN-OS, cPanel, PeopleSoft, TeamCity, React Server Components.
• Review Microsoft 365 sign-in and session activity for token theft given the 79-organization and 2,250-tenant reports.
• Use Senserva's free non-Microsoft exploited-CVE tracker to watch KEV additions daily, and the Microsoft Patch Tracker to rank your open patches by KEV, EPSS, and ransomware linkage.

Sources

• CISA Cybersecurity Advisories: CISA Adds One Known Exploited Vulnerability to Catalog (2026-10-23)
• CISA Cybersecurity Advisories: CISA Adds One Known Exploited Vulnerability to Catalog (2026-10-23)
• SecurityWeek: Attackers Exploit Third Arista VCO Zero-Day in Four Months (2026-10-23)
• CERT-EU: 2026-018: Critical Vulnerabilities in PHP (2026-10-23)
• Help Net Security: Microsoft 365 accounts compromised at 79 organizations, no passwords needed (2026-10-23)
• Cyber Security News: China-Linked Hackers Use ARTEX AI to Target 2,250 Microsoft 365 Tenants After ConnectWise Breach (2026-10-22)
• Cyber Security News: Critical Cisco Expressway Vulnerability Enables Remote Code Execution Attacks (2026-10-23)
• Cyber Security News: Oracle Issues Emergency Java Update for Critical 9.1 HTTPS Trust Vulnerability (2026-10-23)
• Cyber Security News: Hackers Exploit Critical Citrix NetScaler RCE Flaw to Deploy Web Shells and Malware (2026-10-23)
• Cyber Security News: Hackers Actively Exploiting Siemens Software Center Flaw in ClickFix Malware Attacks (2026-10-22)
• BleepingComputer: Microsoft: Windows Server 2016 reaches end of support in January (2026-10-23)

Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-10-24.

Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.