Two Critical Vulnerabilities Actively Exploited: CISA's Latest KEV Alert

CISA maintains a public catalog called the Known Exploited Vulnerabilities (KEV) list as a priority guide for organizations and defenders. When a flaw lands on this list, it signals that exploit code or active attack campaigns have been documented in public reports, threat intelligence, or government agencies. Listing does not mean everyone is vulnerable; it means defenders who use that software need to treat patching as urgent. The list serves as both a warning system and a legal requirement for some U.S. federal contractors, who must address listed vulnerabilities within specific timelines set by CISA binding operational directives.

Collabora Online Built-in CODE Server (an open-source office suite component) and Arista VeloCloud Orchestrator (a network and cloud management appliance used by enterprises) are both infrastructure or productivity tools that run on company networks or cloud environments. CVE-2026-110447 affects Collabora Online with a CVSS score of 9.2, indicating a critical-severity operating system or code execution vulnerability. The second flaw targets Arista VeloCloud Orchestrator, a product commonly deployed in enterprises managing SD-WAN infrastructure and remote site connectivity. Neither is consumer software, but both are widely trusted in their respective niches, making them attractive targets for attackers seeking network access or data exfiltration.

When a vulnerability moves from theoretical to actively exploited, the threat landscape shifts. Attackers have already demonstrated the attack works; they are scanning for instances, trying default credentials, chaining the flaw with other techniques, or selling exploit code on underground forums. Organizations that delay patching past this announcement typically face a narrow window before mass scanning and automated exploitation attempts hit their perimeters. Public disclosure and CISA's official flagging accelerate the timeline. Unlike a zero-day vulnerability reported quietly to the vendor, active exploitation means the attacker community has already begun sharing techniques and tooling.

If your organization runs either Collabora Online or Arista VeloCloud, take the following actions:

1. Check your asset inventory to confirm whether you have these products deployed and in what quantity.
2. Visit the official vendor security advisories for Collabora and Arista to download and review the patched versions and detailed technical descriptions.
3. Test patches in a non-production environment to catch compatibility issues before rolling out to live systems.
4. Prioritize patching systems that are internet-facing, handle sensitive data, or sit on critical network paths.
5. Monitor your logs and network traffic for signs of exploitation attempts, including unusual HTTP requests, authentication failures, or command execution indicators provided by the vendor.
6. Coordinate with your security operations center (SOC) and incident response teams to ensure visibility across all instances.

Do not wait for internal approval cycles or quarterly patch windows when CISA flags active exploitation. This is one of the rare situations where emergency patching is justified and often required by law or contract.

Critical vulnerabilities in enterprise software usually surface when a security researcher finds them during code review, a penetration tester stumbles upon them during an engagement, or a defender detects unusual activity on a compromised system and traces it back to an unpatched flaw. Once one organization or researcher discloses the issue, threat actors move fast to develop and deploy exploits. Collabora Online, being open-source, makes source-code analysis easier for attackers to audit. Arista VeloCloud's use in high-value environments (SD-WAN is common in financial services, retail chains, and government agencies) makes it an attractive target for espionage or data theft campaigns. The CVSS scores and active exploitation confirm these are not theoretical risks but real attack chains being used against real networks right now.

Three common mistakes slow organizations down: first, assuming that your vendor has already applied the patch for you (they have not; you must do it). Second, focusing only on external-facing instances while leaving internal or development copies unpatched, which attackers then use as a lateral pivot point. Third, treating the advisory as an IT-only task and not looping in your security team to help with detection, forensics, and threat hunting if compromise is suspected. Communicate across teams: procurement confirms you have the product, IT deploys the patch, security monitors for related indicators, and leadership understands the business risk and timeline.

Organizations that move fast on known exploited vulnerabilities typically maintain good visibility into their software inventory, have pre-established patch testing and deployment workflows, and monitor CISA's weekly KEV updates as a standing agenda item. The CISA website publishes the KEV catalog with a JSON feed that security teams can ingest into ticketing and vulnerability management systems. Subscribing to vendor security mailing lists and checking your products against CISA's list weekly is low-cost friction that often prevents breaches. When active exploitation is announced, the weeks following the advisory are the most dangerous; organizations that patch within days tend to avoid compromise, while those that delay weeks often end up as incident response cases.