CISA Adds Collabora Online and Arista VeloCloud Flaws to KEV Catalog After Active Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) catalog with two critical-severity flaws, one affecting the Collabora Online Built-in CODE Server and another impacting the Arista VeloCloud Orchestrator (VCO). The agency cited credible evidence of active exploitation in the wild as the basis for both additions.

The move, announced on Friday, carries a familiar weight for defenders: KEV listings are not theoretical advisories. They signal that attackers are already using these weaknesses, and federal civilian agencies — as well as any organization that treats the catalog as a prioritization signal — are expected to patch promptly.

The Collabora Online Flaw

The more severe of the two is tracked as CVE-2026-110447, carrying a CVSS score of 9.2. It affects the Collabora Online Built-in CODE Server, the document-editing component that many organizations deploy alongside self-hosted collaboration platforms. A flaw of this rating typically implies remote, low-complexity exploitation with significant impact on confidentiality, integrity, or availability, though defenders should consult the vendor advisory for the precise attack vector and preconditions.

Collabora Online is widely used in on-premises and private-cloud deployments where organizations want document editing without handing data to a third-party SaaS provider. That same self-hosted posture means patch responsibility sits squarely with the operating organization — there is no vendor-managed update pipeline to fall back on.

The Arista VeloCloud Orchestrator Issue

The second entry involves the Arista VeloCloud Orchestrator (VCO), the centralized management plane for VeloCloud SD-WAN deployments. Orchestrators are high-value targets by design: they hold configuration and policy data for entire network estates and often expose management interfaces that, if compromised, can be leveraged to push changes across many edge devices at once.

The addition of this flaw to the KEV catalog indicates that exploitation is no longer hypothetical. Organizations running VCO — whether on-premises or in a managed service context — should treat patching as urgent and review orchestrator exposure to untrusted networks.

Why the KEV Catalog Matters

The KEV catalog exists to cut through the noise of vulnerability feeds. Rather than asking defenders to triage tens of thousands of CVEs by score alone, CISA maintains a list of flaws with confirmed exploitation. For U.S. federal civilian agencies, inclusion triggers binding remediation timelines under BOD 22-01. For everyone else, it functions as a practical prioritization tool: a KEV entry is a strong argument that a given patch belongs at the top of the queue, regardless of where it falls in a risk-scoring model.

The pattern here — enterprise collaboration software and network orchestration infrastructure — reflects a broader trend. Attackers have consistently favored internet-facing management and productivity platforms because a single compromise can yield access to many downstream systems, credentials, and data stores.

Recommended Actions

Defenders should take the following steps:

  • Patch immediately. Apply the vendor-supplied updates for Collabora Online and Arista VeloCloud Orchestrator. Consult each vendor's advisory for the fixed version and any configuration-side mitigations.
  • Hunt for indicators of compromise. Review orchestrator and CODE Server logs for anomalous authentication events, unexpected configuration changes, or unusual outbound connections.
  • Reduce exposure. Where possible, restrict management interfaces to trusted networks or VPN, enforce strong authentication, and eliminate default or shared credentials.
  • Rotate secrets. If compromise is suspected, rotate credentials and API tokens stored or managed by the affected systems.
  • Inventory affected assets. Self-hosted deployments are frequently undercounted. Confirm which teams operate Collabora or VeloCloud components before assuming you are unaffected.

The two additions underscore a persistent reality: the vulnerabilities that matter most are rarely the ones with the highest theoretical scores, but the ones attackers have already shown they will use. Organizations that treat the KEV catalog as a standing input to their patch management process — rather than an occasional reference — will continue to close the gap between disclosure and exploitation.

For the full original report, see The Hacker News.