Daily Briefing   Edition date: October 25, 2026 · Latest source timestamp incorporated: CISA Known Exploited Vulnerabilities catalog, release of Oct 23, 2026, 3:30 p.m. ET.

SMB Cybersecurity Intelligence Briefing — October 25, 2026

Good morning! Welcome to October 25, 2026’s SMB Cybersecurity Intelligence Briefing.

Today we’re covering Collabora Online – Built-in CODE Server OS Command Injection Vulnerability (CVE-2026-110447), new vulnerabilities actively being exploited, and the actions you should take today to reduce ransomware, fraud, and downtime risk. Let’s get to it.

Assumed environment today: Profile A (Microsoft 365 + Windows endpoints).

Today’s decision summary

1. Top story of the day

Collabora Online – Built-in CODE Server OS Command Injection Vulnerability (CVE-2026-110447)

• What happened: On Oct 23, 2026 CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog, confirming active exploitation.
• Why it matters: Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running. Data exposure and downtime on that system are the risk. CISA lists ransomware use as Unknown.
• Threat type: Exploited Vulnerability
• Who is targeted: Organizations running Collabora Online – Built-in CODE Server (a file-sharing or collaboration server). Industry and region: Not reported.
• Attack path: Initial access: network access, with no privileges required (from the NVD vector). Impact as CISA describes; further detail Not reported.

Action timeline

• Do in 4 hours: Check whether you run Collabora Online – Built-in CODE Server and note its version. If its management page faces the internet, limit it to a VPN or fixed addresses.
• Do in 24 hours: Apply the vendor’s mitigations or updates, or stop using the product if none are available (CISA required action), per the vendor notice below, then run the compromise check.
• Do in 7 days: List every internet-facing system you run and who updates it.

Assume compromise: patching locks out new attackers; it does not evict one already inside. If this system was internet-reachable at any time since exploitation began (start date not reported), run a compromise assessment, not patching alone. CISA also marks this entry for forensic triage. Look for new administrator or local accounts, unfamiliar sign-ins, unexpected outbound connections, unplanned service restarts and configuration changes you did not make. Keep the logs before rebuilding. IOCs: not reported by authoritative sources.

• Verification: In the product’s admin page, compare the installed version with the fixed version in the vendor notice (not reproduced here), then review the account list and recent sign-ins.
• Fallback if you can’t patch today: remove the management page from the public internet (VPN or address allow-list at your firewall) and watch its logs daily.
• If you have no IT staff: Ask whoever manages it: “Do we run Collabora Online – Built-in CODE Server, what version, and when was it updated?” If nobody knows, have them unplug it from the internet.
• Impact score: 4 of 5: exploited and reachable over the network, but it needs specific deployment conditions to be present, and it is rated high for confidentiality, integrity and availability.
• If you use an MSP: “Send me today the installed version of Collabora Online – Built-in CODE Server on every system you manage for us and its last update date, or confirm in writing we do not run it.”

Benchmark only: CISA’s federal due date is Oct 26, 2026; it does not bind your business.

Sources: CISA Known Exploited Vulnerabilities catalog, entry added Oct 23, 2026; NVD record for CVE-2026-110447, published Oct 14, 2026; Vendor or agency notice on help.nextcloud.com (publication date not reported); Vendor or agency notice on github.com (publication date not reported).

2. Active threat & vulnerability updates

Status updates

• CVE-2026-114625 (Arista VeloCloud Orchestrator) led the previous edition; its status has not changed.

Earlier on the list Durable (not new)

Older than 72 hours, shown for context:

• CVE-2026-114625 (Arista VeloCloud Orchestrator), added Oct 23, 2026. Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. CISA lists ransomware use as Unknown.
• CVE-2026-96656 (Plex Media Server), added Oct 20, 2026. Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. CISA lists ransomware use as Unknown.
• CVE-2026-96655 (Plex Media Server), added Oct 20, 2026. Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. CISA lists ransomware use as Unknown.
• CVE-2026-96654 (Plex Media Server), added Oct 20, 2026. Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. CISA lists ransomware use as Unknown.

Ransomware operators often go after backups once they are inside a network. A restore that works is the cheapest way to take away their leverage.

Sources: CISA Known Exploited Vulnerabilities catalog.

3. Security protocols & hardening

Exposure triage for an exploited internet-facing product

• Risk reduced: Intrusion through a flaw attackers are already using.
• Minimal steps:

1. Find every instance of the affected product, including old ones nobody owns.
2. Take its management interface off the public internet before you update it.
3. Apply the vendor’s fix, then run the compromise assessment above.
4. Rotate any credentials or keys the product stored.

• Verification: The installed version matches the vendor notice, the management page is unreachable from outside, and the account and configuration review found nothing unexpected.
• Common failure mode: Teams update the product and stop, leaving an intruder who got in before the update, and leave the old management page open.
• Cost: Low. Time to implement: 2 to 4 hours.

4. Tools & technology

Built-in controls first

• Your firewall or router’s published-services list. Minimum configuration: Open the port-forwarding or published-services page and remove entries nobody can name an owner for. Verification: From a phone on mobile data, not your office network, the removed addresses no longer answer.
• The affected product’s own audit log (or Event Viewer on a Windows host). Minimum configuration: Filter for account creation, failed sign-ins and service restarts since you installed it. Verification: You can explain every entry as expected, or you have escalated it.

5. Operational metrics snapshot

CISA’s Known Exploited Vulnerabilities catalog (release of Oct 23, 2026, 3:30 p.m. ET) lists 1,756 entries. In the 7 days to Oct 25, 2026, 8 were added, and 0 of those are marked as used in ransomware campaigns.

Sources: CISA Known Exploited Vulnerabilities catalog, release of Oct 23, 2026, 3:30 p.m. ET.

Closing

Tomorrow’s watch list:

• Any change to CISA’s ransomware flag or the vendor notice for CVE-2026-110447
• CISA additions that name backup or file-sharing products
• Vendor advisories for your backup software

Question of the day: When did we last restore a real file from backup, and who did it?

Daily security win (10 minutes or less): Open your backup console’s job history. Risk reduced: Silent backup failures. How to verify: The last seven days show successful runs and no failed or warning jobs.

This weekday’s theme: Monday is backup day. A weekend is a long time for a failed backup job to go unnoticed, and a restore test at the start of the week leaves five working days to fix what it finds.

Go deeper

• Patching known exploited vulnerabilities
• Internet-facing exposure
• MSP security expectations
• Restore testing

This briefing provides general information for operational risk reduction and is not legal, insurance, or incident-response advice. Verify all actions against your own environment and current vendor advisories before applying them. Vulnerability status and patch guidance change rapidly; confirm against the linked sources before acting.