CISA Flags Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud, Urges Immediate Patching

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a stark warning, adding two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-110447 affecting Collabora Online Built-in CODE Server and CVE-2026-114625 in Arista VeloCloud Orchestrator (VCO). Both are actively being exploited in the wild. CVE-2026-110447, with a CVSS score of 9.2, is an operating system command injection vulnerability that can lead to remote code execution via "proxy.php" when the CODE local document server isn't running. CVE-2026-114625, rated at a critical 9.9, is an SQL injection flaw in on-premise versions of Arista VCO, allowing remote attackers to access privileged internal functionality. These disclosures are critical for any organization utilizing these products. The active exploitation means that attackers are already leveraging these weaknesses to gain unauthorized access, potentially leading to data exfiltration, service disruption, and further compromise of internal networks. For Collabora Online users, the risk is immediate remote code execution, which can grant attackers full control over affected servers. For Arista VCO users, the SQL injection can lead to privileged access, allowing attackers to masquerade as superuser operators and access internal functionalities not meant for external exposure. The impact extends beyond the immediate compromise, as successful exploitation can serve as a beachhead for deeper network penetration and persistent remote access. This situation underscores a persistent trend in network security: the increasing targeting and exploitation of internet-facing edge devices. Verizon's 2026 Data Breach Investigations Report highlighted that vulnerability exploitation has surpassed stolen credentials as the leading initial access vector, largely driven by attacks on edge devices and VPNs. This shift emphasizes that traditional perimeter defenses are no longer sufficient. The rapid weaponization of newly disclosed vulnerabilities, often within hours or days of public announcement, is a consistent challenge. The use of AI by attackers to automate vulnerability scanning and exploit generation further accelerates this timeline, making timely patching more critical than ever. Practitioners must immediately identify all instances of Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator within their environments. Patches for CVE-2026-110447 were released in September 2026 (version 26.4.303), and for CVE-2026-114625 in October 2026 (versions 5.2.3.18, 6.1.3.10, and 6.4.2.12). Federal Civilian Executive Branch (FCEB) agencies have been advised to apply these fixes by October 26, 2026, a deadline that all organizations should strive to meet. Beyond immediate patching, organizations should strengthen their continuous exposure management programs, moving away from periodic assessments to real-time monitoring and remediation. This includes rigorous inventory management of all internet-facing assets, regular vulnerability scanning, and proactive threat intelligence integration to stay ahead of emerging exploits. Furthermore, implementing a robust zero-trust architecture can help mitigate the impact of successful breaches by limiting lateral movement within the network, even if an edge device is compromised.