← All stories

Threat intel

CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud

By The Hacker News1 min read

CISA has added two critical vulnerabilities affecting Collabora Online's Built-in CODE Server and Arista VeloCloud Orchestrator to its Known Exploited Vulnerabilities catalog, citing reports of active exploitation. One of the flaws, CVE-2026-110447, carries a CVSS score of 9.2.

Cover for a threat-intel story

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two critical-severity vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing reports of active exploitation in the wild, according to The Hacker News.

The flaws affect Collabora Online's Built-in CODE Server and Arista's VeloCloud Orchestrator (VCO). Collabora Online is a widely deployed open-source office suite frequently integrated into self-hosted collaboration platforms, while VeloCloud Orchestrator is used by enterprises and service providers to centrally manage software-defined wide-area network (SD-WAN) deployments. Both products therefore sit in positions where compromise could have a broad operational impact.

The first vulnerability listed, CVE-2026-110447, carries a CVSS score of 9.2 out of 10, placing it firmly in the critical range. The source item was truncated before the full technical descriptions of the flaws, the identifier of the second CVE, affected versions, and available fixes could be captured, so those details are not confirmed here.

Inclusion in the KEV catalog indicates that CISA holds evidence of real-world exploitation, not just theoretical risk. For U.S. federal civilian agencies, KEV additions typically trigger binding remediation deadlines under CISA's operational directives, and the agency urges all organizations to treat listed flaws as patching priorities.

Organizations running Collabora Online's Built-in CODE Server or Arista VeloCloud Orchestrator should consult CISA's KEV catalog and the respective vendor advisories for affected versions and mitigation guidance, and apply updates as soon as possible.

Source: The Hacker News

How to read this

Authorized-only · evidence-based · point-in-time. Aegis cannot guarantee the absence of weaknesses or hidden devices. On this machine, live external HTTP/TLS may be network-blocked and shown as an honest coverage gap. Severity and confidence are kept separate. Finished assessments persist in the encrypted store while durable storage is bound. A theme choice may persist in this browser. Export remains available for a copy you can take with you.