CISA adds two critical vulnerabilities to its KEV list, citing active exploitation. Learn what they are, why they matter, and how to protect your systems.
You know that feeling when you hear about a security flaw being actively exploited? It's like finding out someone's been trying your front door handle while you're at work. That's exactly what's happening with two critical vulnerabilities that CISA just added to its Known Exploited Vulnerabilities (KEV) list. So grab your coffee, and let's break down what this means for you.
### What Exactly Did CISA Flag?
On Friday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities to its KEV catalog. These impact Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO). Both are being actively exploited in the wild, which is why they're getting so much attention.
The first one, CVE-2026-110447, has a CVSS score of 9.2—that's critical severity, folks. It's an operating system command injection flaw in Collabora Online. In plain English, it means an attacker could run their own commands on your server. Not good.
The second vulnerability affects Arista VeloCloud Orchestrator. While the details are still emerging, it's serious enough that CISA is urging immediate action. These aren't just theoretical risks; they're being used by attackers right now.
### Why Should You Care?
If you're running either of these products, you need to pay attention. Collabora Online is a popular open-source office suite that integrates with Nextcloud and other platforms. Arista VeloCloud is used for SD-WAN and network orchestration. Both are common in enterprise environments.
But even if you're not directly using them, this is a wake-up call. Attackers are constantly scanning for unpatched systems. The KEV list is basically a hit list for cybercriminals—they know these vulnerabilities work, so they're going after them hard.
> "The KEV list is a signal to defenders: patch these now, or you're leaving the door wide open."
That quote from a security researcher sums it up nicely. It's not about if you'll be targeted, but when.
### What Should You Do Right Now?
First, check if you're running Collabora Online Built-in CODE Server or Arista VeloCloud Orchestrator. If you are, apply the latest patches immediately. Don't wait for the weekend or your next maintenance window. This is urgent.
Second, if you can't patch right away, consider isolating those systems from the internet. Limit access to only necessary IPs. It's not a perfect solution, but it buys you time.
Third, review your logs for any signs of unusual activity. Look for strange command executions or unexpected network traffic. Attackers often leave traces—you just need to know where to look.
### The Bigger Picture
This isn't the first time CISA has flagged actively exploited flaws, and it won't be the last. The agency added these to the KEV list to give organizations a clear deadline: patch within a certain timeframe (usually a few weeks) or face the consequences. It's a way to prioritize the most critical threats.
What's interesting here is that both vulnerabilities are in tools that are often overlooked. Collabora Online and Arista VeloCloud are not the flashiest products, but they're deeply embedded in many networks. That's exactly why attackers love them—they're low-hanging fruit.
### Final Thoughts
Security is a moving target. The moment you think you're safe, a new vulnerability pops up. The best defense is staying informed and acting fast. So, check your systems, apply those patches, and keep an eye on CISA's KEV list. It's one of the best resources out there for staying ahead of the bad guys.
And hey, if you're not sure where to start, reach out to your IT team or a trusted security advisor. Don't go it alone. We're all in this together.
