<![CDATA[🔴 Critical: CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud]]>

<![CDATA[🔴 Critical: CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud]]>The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, following reports that both are being actively exploited in the wild. The affected products are Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO).

The first flaw, tracked as CVE-2026-110447, carries a CVSS score of 9.2, placing it in the critical severity range. The article excerpt does not provide further technical detail on the vulnerability's root cause beyond its operating context.

The second vulnerability affects Arista VeloCloud Orchestrator (VCO), though the source material does not disclose a specific identifier or CVSS score for this issue.

Key points for defenders:

Both vulnerabilities are rated critical and have been observed exploited in real-world attacks.
CISA's KEV addition signals that federal remediation timelines now apply, and private organizations should treat the flaws as urgent.
Affected products: Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO).

Organizations running either product should prioritize patching and check their exposure immediately. As always, review the official KEV entry for the authoritative list of affected versions and required actions.

Source: The Hacker News

Does your organization run Collabora Online or Arista VeloCloud Orchestrator, and how are you handling remediation?

]]>https://xploitlk.com/topic/773/critical-cisa-flags-two-actively-exploited-critical-flaws-in-collabora-online-and-arista-velocloudRSS for NodeTue, 27 Oct 2026 07:24:50 GMTSat, 24 Oct 2026 08:30:18 GMT60