CISA Warns of Active Exploitation in Collabora Online and Arista VeloCloud

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities affecting Collabora Online and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV) catalogue. The agency cited confirmed reports that both flaws are being actively exploited by threat actors in the wild.

The first vulnerability, tracked as CVE-2026-110447, carries a critical CVSS severity score of 9.2. It affects the Collabora Online Built-in CODE (Collabora Online Development Edition) Server. This flaw is identified as an operating system command injection vulnerability, which could allow an attacker to execute arbitrary commands on the underlying host system.

Collabora Online is widely used as a self-hosted, cloud-based office suite, often integrated into platforms like Nextcloud and ownCloud. Given the high severity of the flaw and its potential for full system compromise, administrators using the CODE server are urged to verify their patch status immediately.

Exploitation of Arista VeloCloud Orchestrator

The second addition to the KEV list involves a critical security issue in the Arista VeloCloud Orchestrator (VCO). While specific technical details regarding the attack vector were limited in the initial disclosure, CISA confirmed that the vulnerability is being leveraged by attackers to target infrastructure management systems.

VeloCloud Orchestrator serves as a central management platform for software-defined wide area network (SD-WAN) deployments. A compromise of such a system can provide attackers with significant visibility and control over an organisation’s network traffic and configuration.

Remediation Mandates

In accordance with Binding Operational Directive (BOD) 22-01, Federal Civilian Executive Branch (FCEB) agencies are required to remediate these vulnerabilities within a specific timeframe, typically three weeks. While the directive specifically applies to federal agencies, CISA strongly advises all organisations to prioritise these updates to mitigate the risk of exposure.

The inclusion of these flaws in the KEV catalogue serves as a high-priority signal to the broader cybersecurity community. Threat actors frequently target unpatched management interfaces and collaborative tools to gain an initial foothold or escalate privileges within enterprise environments. Organisations should consult the latest security advisories from Collabora and Arista to ensure all instances are updated to a non-vulnerable version.