CISA Issues Alert on Two Critical Vulnerabilities Being Actively Exploited

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) published an alert identifying two critical-severity vulnerabilities in active use by attackers. CVE-2026-110447 affects Collabora Online's Built-in CODE Server and carries a CVSS score of 9.2, indicating severe impact. A second flaw in Arista VeloCloud Orchestrator (VCO) was flagged simultaneously. When CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, it means the agency has received credible reports that attackers are already weaponizing it in real-world campaigns.

This distinction matters because it separates theoretical security issues from active threats. Organizations monitoring CISA's KEV list use it as a trigger for emergency patching; many follow a standing directive to patch known exploited flaws within a specific window, often 48 hours. The timing of this alert—published on a Friday—places the burden on security teams to respond over a weekend or start their response Monday with reduced staffing.

Neither CISA nor the source documentation released with the alert disclosed which researcher or organization reported the active exploitation. Industry practice is that vulnerability details often reach CISA through security vendors monitoring honeypots and customer telemetry, law-enforcement intelligence sharing, or ethical researchers who voluntarily report to the agency. The fact that two separate products were flagged in the same week suggests either a coordinated research effort or separate detection of in-the-wild activity by different parties.

For Collabora Online, the flaw resides in the Built-in CODE Server component, a self-hosted online office suite used by organizations that need document collaboration without relying on cloud providers. Arista VeloCloud Orchestrator is the management and orchestration layer for SD-WAN deployments across enterprise networks. Both are foundational infrastructure tools; a compromise could give attackers persistence or lateral movement capability throughout the victim's network.

The CVSS score of 9.2 for the Collabora flaw reflects near-maximum severity. On the CVSS scale, 9.0 and above typically means an attacker can compromise the system remotely without authentication or with minimal user interaction. This differs from vulnerabilities requiring administrative credentials or physical access; those typically score lower despite affecting sensitive systems. The practical implication is that the barrier to entry for attackers is low, and the window between public awareness and widespread compromise can narrow rapidly.

Organizations running these products face a compounding problem: discovery lag. Many businesses do not have complete asset inventories. Teams managing Collabora deployments may not immediately know how many instances they operate, where they are, or who uses them. The same applies to VeloCloud; SD-WAN architectures span branch offices, remote locations and cloud integrations. A security team at a mid-size company might spend 24 hours just identifying vulnerable systems before patching can begin.

CISA's KEV catalog has become a canonical reference point for threat prioritization, yet confusion persists about what the list does and does not guarantee. An entry means exploitation has been observed, but it does not mean every variant of the software is vulnerable, nor does it guarantee that patches are available. In some cases, vendors publish patches weeks or months before attackers find a working exploit; in others, proof-of-concept code surfaces before a fix exists. The lag between discovery and patch release varies widely depending on the vendor's release cycle and the vulnerability's complexity.

Public disclosure of active exploitation creates a self-reinforcing cycle: once details spread, less sophisticated attackers adopt the same techniques by copying exploit code published on forums or GitHub. This means that the real danger window extends far beyond the first hours after the CISA alert. Unpatched systems remain at risk for weeks or months, particularly in organizations with slow change management processes or budget constraints that delay security updates.

The response sequence depends on whether your organization runs either product. Start by checking your asset management systems, ticketing tools, and documentation to confirm whether Collabora Online or Arista VeloCloud is deployed in your environment.

1. Search your network documentation, inventory systems and procurement records for references to Collabora Online or Arista VeloCloud.
2. Contact the team or department that owns collaboration or SD-WAN infrastructure; they may know of deployments that security teams were not aware of.
3. Check the official vendor security advisories for each product; both Collabora and Arista will have published detailed patch information and workarounds if patches are not immediately available.
4. Prioritize patching or isolating affected systems; if no patch exists yet, consider network segmentation or disabling the vulnerable component until a fix is released.
5. Monitor CISA's updates on this alert; additional details or workarounds may be published after the initial advisory.

For organizations that do not run these products, the alert still carries a lesson: the speed at which threats move from known to weaponized continues to accelerate. Building a process to ingest CISA's KEV feed and cross-reference it with your own asset inventory—whether manually or via automation—is now a baseline security hygiene task, not an optional enhancement.

Ten years ago, vulnerability alerting was a lower-priority background process; many organizations applied patches quarterly or semi-annually. The model has shifted to a threat-driven, just-in-time approach. When CISA flags active exploitation, the expectation from customers, regulators and liability frameworks is that an organization responds within hours, not weeks. This has forced security teams to build monitoring and deployment tooling that can detect and act on alerts at scale.

The specific CVE numbers for these two flaws matter less than understanding why they landed on the KEV list: because attackers are using them right now. If you manage infrastructure, check your asset list today and verify your patch deployment pipeline. If your vendor is Collabora or Arista, expect contact from customers asking whether they are affected. The vulnerability window is open, and the clock started when the alert was published.

What does CISA's Known Exploited Vulnerabilities list actually mean?

It means CISA has received credible reports of attackers using the flaw in real-world attacks. An entry on the KEV list is a signal that patching should jump to the top of the priority queue, typically within 24-72 hours depending on organizational policy.

Do I need to patch immediately if I run Collabora Online?

Yes. The CVSS 9.2 score and active exploitation status mean the risk of compromise is high. Check the official Collabora security advisory for patch availability and apply it as soon as your change management process permits.

What should I do if a patch is not available yet?

If the vendor has not released a fix, isolate the affected system from untrusted networks, disable the vulnerable feature if possible, or take the service offline until a patch is released. Contact the vendor for an estimated timeline and interim mitigations.

How do I know if my organization uses Arista VeloCloud?

Check with the team responsible for network infrastructure and SD-WAN deployment. Review procurement records, infrastructure diagrams, and network management tool configurations. If unsure, contact your IT operations center or infrastructure leadership directly.

Should I monitor CISA's KEV list regularly?

Yes. Many organizations integrate the KEV feed into their vulnerability management or security information and event management (SIEM) systems to trigger alerts whenever a known exploited flaw is added. This reduces manual checking overhead and ensures no critical alert is missed.

Source: The Hacker News