CISA Adds Two Actively Exploited Critical Vulnerabilities to Known Exploited List

The Known Exploited Vulnerabilities (KEV) catalog is CISA's public list of security flaws that attackers are actively using to compromise systems. Being added to this list does not mean a vulnerability is newly discovered; it means that CISA has corroborated real-world exploitation attempts, often through intelligence from federal agencies, threat intelligence vendors or victims themselves. Organizations on the KEV list face mandatory patching deadlines if they are federal contractors or operate critical infrastructure, but the announcement also signals to every other user that this is not a theoretical risk.

CVE-2026-110447 affects Collabora Online Built-in CODE Server, a cloud-based office suite used for collaborative document editing. With a CVSS score of 9.2, this is a critical-severity flaw, meaning it requires little to no user interaction to exploit. Arista VeloCloud Orchestrator (VCO), a network management and SD-WAN platform used by enterprises to centralize control of branch office connectivity, also carries a critical flaw in the CISA advisory. Both flaws are confirmed to be exploited by threat actors already; waiting for a convenient maintenance window is no longer an option.

Collabora Online serves organizations that rely on open-source alternatives to Microsoft Office, especially government agencies, educational institutions and companies in Europe that prioritize software independence. Arista VeloCloud Orchestrator is widely deployed in enterprise networks for managing SD-WAN connections across multiple office locations. Compromise of either platform can lead to data exfiltration, persistent network access or disruption of critical workflows. The overlap between these two products is smaller, but the message is the same: both are plausible initial entry points for a supply-chain or targeted network attack.

CISA's advisory typically includes details about attack vectors once exploitation is confirmed and patched. An operating-system level vulnerability in Collabora Online likely permits unauthenticated remote code execution, whereas Arista VeloCloud Orchestrator flaws often center on improper authentication, API access control or configuration management. Threat intelligence reports confirm that vulnerability scanners and automated exploit code are already in circulation within attacker communities. This pattern accelerates from public disclosure to widespread misuse within weeks, not months.

If your organization uses either Collabora Online or Arista VeloCloud, treat patching as urgent:

1. Check your current version against CISA's advisory to confirm whether you are affected.
2. Test patches in a non-production environment before rolling out to production systems.
3. If immediate patching is not possible, apply temporary mitigations such as network segmentation or access controls while you prepare the patch.
4. Monitor network logs and authentication attempts for signs of suspicious activity.
5. Enable verbose logging on these systems to detect exploitation attempts.

For organizations that are federal contractors or manage critical infrastructure, CISA's directive typically sets a patching deadline within 30 days from the advisory date. Non-federal organizations should follow the same urgency, because the exploit is public and widely available.

CISA maintains the KEV catalog as part of U.S. cybersecurity infrastructure defense. Many vulnerabilities are added after law-enforcement or intelligence agencies observe active exploitation targeting government networks or critical infrastructure. This means the announcement itself often lags behind the actual exploitation, sometimes by weeks or months. The catalog serves as both a warning and a historical record of which flaws pose the greatest real-world risk. Other countries' cybersecurity agencies publish similar lists, but the CISA KEV remains the most frequently cited benchmark for exploitation probability.

The addition of Collabora and Arista flaws to the KEV list should trigger an audit in any organization that uses these products or plans to deploy them. A critical vulnerability that is known to be actively exploited is among the highest-priority security events in any risk framework.

CISA's Known Exploited Vulnerabilities list is a signal that attackers have moved past scanning and testing into routine exploitation. Collabora Online and Arista VeloCloud users must prioritize patch deployment over schedule convenience. Begin your patch process today: verify your version, check vendor advisories for specific remediation steps, and test in a staging environment. If your organization operates critical infrastructure or contracts with the federal government, mark your calendar for the CISA-mandated deadline; for all others, treat the advisory as if it were a deadline anyway, because threat actors certainly are.

What is the difference between a vulnerability and a known exploited vulnerability. A vulnerability is any security flaw; a known exploited vulnerability is one that attackers have weaponized and are actively using. The KEV catalog narrows the focus to flaws confirmed in real attacks.

Do I need to patch immediately if I am not a government contractor. Yes. The fact that CISA lists a flaw means exploit code is public or widely available. Attackers do not wait for deadlines; they begin scanning as soon as the advisory appears.

Where can I find the full CISA advisory and patch details. Visit CISA.gov and search the Known Exploited Vulnerabilities catalog by CVE number. Vendor advisories from Collabora and Arista contain patch download links and version numbers.

What should I do if I cannot patch immediately. Isolate the affected system from untrusted networks, restrict access to known users only, and enable detailed logging. Develop a patching timeline and document the temporary controls you have put in place.

Can I be targeted if I run a small office or non-critical business. Yes. Attackers use vulnerability scanners to find vulnerable systems indiscriminately. Small organizations often lack defenses precisely because they assume they are not targets, making them attractive opportunistic victims.

Source: The Hacker News