CISA Warns of Actively Exploited Flaws in Collabora Online and Arista VeloCloud
CISA adds two critical vulnerabilities to its KEV catalog due to active exploitation. Organizations using Collabora Online or Arista VeloCloud should prioritize patching.
TL;DR
- CISA adds CVE-2026-110447 and another critical flaw to its Known Exploited Vulnerabilities list.
- Both vulnerabilities affect widely used enterprise collaboration and networking platforms.
- Active exploitation reported—patching should be treated as a high-priority incident response task.
- CVE-2026-110447 impacts Collabora Online Built-in CODE Server with a CVSS score of 9.2.
- Arista VeloCloud Orchestrator also confirmed under active attack.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities (KEV) catalog with two newly identified flaws—one in Collabora Online Built-in CODE Server and another in Arista VeloCloud Orchestrator. Both vulnerabilities are reportedly being actively exploited by threat actors in real-world attacks, increasing the urgency for impacted organizations to apply patches immediately.
With a CVSS severity score of 9.2, CVE-2026-110447 poses a significant risk to systems running Collabora's office suite alternative. Meanwhile, Arista’s VeloCloud Orchestrator vulnerability further expands the landscape of network infrastructure risks that enterprises must monitor closely. These additions highlight the persistent targeting of business-critical applications and infrastructure components by cybercriminals.
Vulnerability Details
- CVE-2026-110447 affects Collabora Online Built-in CODE Server with a CVSS score of 9.2, indicating critical severity.
- The second flaw impacts Arista VeloCloud Orchestrator (VCO), though specific technical details were not disclosed in initial advisories.
- Both vulnerabilities have been observed in active exploitation campaigns, prompting their inclusion in CISA's KEV list.
Recommended Actions
- Organizations using Collabora Online or Arista VeloCloud should verify current versions and apply vendor-released patches immediately.
- Review network logs for signs of unauthorized access or suspicious activity related to these products.
- Prioritize asset inventory updates to identify all instances of affected software across IT environments.
- Consider implementing enhanced monitoring or temporary network segmentation if immediate patching is not feasible.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.