CVE-2026-110447 & Arista VeloCloud Exploitation: CISA KEV Alert and Immediate Mitigation Guide

---
title: Collabora Online Exploitation Attempt - Suspicious Child Process
id: 8f4e2a91-3b7c-4d9e-a5f1-2c8d6e4b1a23
status: experimental
description: Detects suspicious child processes spawned by Collabora Online server (loolwsd/coolwsd) indicating potential exploitation of CVE-2026-110447
references:
  - https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html
author: Security Arsenal
date: 2026/10/25
tags:
  - attack.execution
  - attack.t1059
  - attack.t1203
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/loolwsd'
      - '/coolwsd'
      - '/loolkit'
      - '/coolkit'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/netcat'
      - '/python'
      - '/perl'
      - '/php'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate document conversion utilities
  - Administrative scripts within Collabora containers
level: high
---
title: Collabora Online Exploitation - Outbound Network Connection
id: 2a8f4e6c-9d3b-4a5f-8e7c-1b6d9a4f2e8c
status: experimental
description: Detects Collabora server processes making unexpected outbound network connections, potentially indicating post-exploitation activity or data exfiltration
references:
  - https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html
author: Security Arsenal
date: 2026/10/25
tags:
  - attack.exfiltration
  - attack.t1071
  - attack.t1105
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith:
      - '/loolwsd'
      - '/coolwsd'
      - '/loolkit'
      - '/coolkit'
  filter_private:
    DestinationIp|startswith:
      - '10.'
      - '172.16.'
      - '192.168.'
      - '127.'
  condition: selection and not filter_private
falsepositives:
  - Document fetching from external cloud storage
  - Font or dictionary updates
level: medium
---
title: Arista VeloCloud Orchestrator - Suspicious API Activity
id: 5c9d2f8a-4e7b-4c6d-9a1f-3e8b2d5c7a9f
status: experimental
description: Detects suspicious process execution patterns on Arista VeloCloud Orchestrator appliances indicating potential compromise or unauthorized administrative access
references:
  - https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html
author: Security Arsenal
date: 2026/10/25
tags:
  - attack.execution
  - attack.t1059
  - attack.t1078
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
      - '/opt/velocloud'
      - 'vco-api'
      - 'orchestrator'
  selection_suspicious:
    CommandLine|contains:
      - 'wget '
      - 'curl '
      - 'bash -i'
      - 'nc -e'
      - '/tmp/'
      - '/dev/tcp/'
      - 'chmod 777'
  condition: selection and selection_suspicious
falsepositives:
  - Legitimate VeloCloud administrative scripting
  - Automated backup operations
level: high

// Hunt for Collabora Online exploitation indicators via Syslog
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName in ("loolwsd", "coolwsd", "loolkit", "coolkit")
| where SyslogMessage has_any ("sh", "bash", "curl", "wget", "nc ", "python", "perl")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP
| order by TimeGenerated desc;

// Hunt for suspicious network connections from Collabora processes
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in ("loolwsd", "coolwsd", "loolkit", "coolkit")
| where RemoteIP !startswith "10." and RemoteIP !startswith "192.168." and RemoteIP !startswith "172."
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl
| order by TimeGenerated desc;

// Hunt for Arista VeloCloud management interface anomalies
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DeviceVendor == "Arista" or DeviceProduct contains "VeloCloud"
| where Activity contains "API" or Activity contains "Config"
| where SourceUserPrivileges == "Guest" or SourceUserPrivileges == "Unknown"
| project TimeGenerated, SourceIP, DestinationHostName, Activity, SourceUserPrivileges, Message
| order by TimeGenerated desc;

-- Hunt for Collabora Online Exploitation - Suspicious Process Chains
SELECT 
    Pid,
    Ppid,
    Name,
    Exe,
    CommandLine,
    Username,
    CreateTime,
    pslist(Pid=Ppid).Name as ParentName,
    pslist(Pid=Ppid).Exe as ParentExe
FROM pslist()
WHERE 
    (ParentName =~ "loolwsd|coolwsd|loolkit|coolkit" 
     OR ParentExe =~ "loolwsd|coolwsd")
    AND (Name =~ "sh|bash|dash|curl|wget|nc|python|perl|php"
         OR CommandLine =~ "wget |curl |bash -i|nc -e|/dev/tcp/")
ORDER BY CreateTime DESC

#!/bin/bash
# CVE-2026-110447 Collabora Online Remediation Script
# Run as root or with sudo on Collabora/CODE Server host

echo "[*] Checking Collabora Online version and status..."

# Check if Collabora is running and get version
if systemctl is-active --quiet loolwsd; then
    echo "[+] Collabora Online (loolwsd) is running"
    CURRENT_VERSION=$(loolwsd --version 2>/dev/null || echo "Version unknown")
    echo "[+] Current version: $CURRENT_VERSION"
elif systemctl is-active --quiet coolwsd; then
    echo "[+] Collabora Online (coolwsd) is running"
    CURRENT_VERSION=$(coolwsd --version 2>/dev/null || echo "Version unknown")
    echo "[+] Current version: $CURRENT_VERSION"
else
    echo "[!] Collabora Online service not detected via systemctl. Checking for processes..."
    pgrep -a loolwsd || pgrep -a coolwsd || echo "No Collabora processes found"
fi

echo ""
echo "[*] Checking for suspicious child processes..."
# Check for suspicious processes spawned by Collabora
SUSPICIOUS=$(ps auxf | grep -E "(loolwsd|coolwsd|loolkit|coolkit)" | grep -E "(bash|sh|curl|wget|nc|python)" | grep -v grep)
if [ -n "$SUSPICIOUS" ]; then
    echo "[ALERT] Suspicious child processes detected:"
    echo "$SUSPICIOUS"
    echo "[ACTION] Investigate immediately and consider isolating this host"
else
    echo "[+] No obvious suspicious child processes found"
fi

echo ""
echo "[*] Checking listening ports..."
# Verify Collabora is not exposed unnecessarily
if netstat -tlnp 2>/dev/null | grep -E ":9980.*0.0.0.0" | grep -E "(loolwsd|coolwsd)"; then
    echo "[WARNING] Collabora is listening on all interfaces (0.0.0.0:9980)"
    echo "[ACTION] Restrict to localhost or internal interface only"
    echo "    Edit /etc/loolwsd/loolwsd.xml or /etc/coolwsd/coolwsd.xml"
    echo "    Set <host> to 127.0.0.1 or your internal IP"
elif ss -tlnp 2>/dev/null | grep -E ":9980.*0.0.0.0" | grep -E "(loolwsd|coolwsd)"; then
    echo "[WARNING] Collabora is listening on all interfaces (0.0.0.0:9980)"
    echo "[ACTION] Restrict to localhost or internal interface only"
else
    echo "[+] Collabora appears to be properly bound to localhost/internal interface"
fi

echo ""
echo "[*] Checking for recent modifications to web directories..."
# Check for recently modified files (potential webshells)
find /usr/share/loolwsd /usr/share/coolwsd /opt/collabora -type f -mtime -7 2>/dev/null | head -20
if [ $? -eq 0 ]; then
    echo "[+] No recently modified files in Collabora directories"
else
    echo "[INFO] Review recently modified files above for unauthorized changes"
fi

echo ""
echo "[*] Immediate mitigation steps:"
echo "1. UPDATE IMMEDIATELY: Run 'apt update && apt upgrade collabora-online*' or 'yum update collabora-online*'"
echo "2. Verify you are running version 25.04.4.3 or later (or latest available)"
echo "3. If you cannot patch immediately, restrict access:"
echo "   - Bind Collabora to localhost only (127.0.0.1:9980)"
echo "   - Place behind reverse proxy with strict allowlists"
echo "   - Block external access to /cool/convert-to and /lool/convert-to endpoints"
echo "4. Review authentication logs for unusual access patterns"
echo ""
echo "[*] Checking CISA KEV status..."
echo "[CONFIRMED] CVE-2026-110447 is actively exploited. Apply updates within 24-48 hours per CISA BOD 22-01 guidance."