CISA just flagged two critical vulnerabilities in Collabora Online and Arista VeloCloud that are being actively exploited. Here's what you need to know and do.
You know that feeling when you see a security alert and think, "Not another one"? I get it. But this time, it's worth paying attention. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) just added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. And these aren't just theoretical risks—they're being actively exploited in the wild right now.
### What's the Big Deal?
The two flaws affect Collabora Online's Built-in CODE Server and Arista's VeloCloud Orchestrator (VCO). Both are critical severity, with one scoring a whopping 9.2 on the CVSS scale. That's about as bad as it gets. If you're running either of these in your stack, you'll want to drop everything and patch. Seriously.
### The Nitty-Gritty on the Flaws
Let's break it down. The first one, CVE-2026-110447, hits Collabora Online. It's an operating system command injection vulnerability. In plain English: an attacker could sneak in malicious commands and take over your server. Not good. The second flaw, affecting Arista VeloCloud Orchestrator, hasn't been detailed yet in the advisory, but CISA's warning is enough to raise eyebrows. Both are being used by attackers as we speak.
### Why Should You Care?
Maybe you're thinking, "I don't use those products." Fair enough. But here's the thing: supply chains are tangled. Your vendors might use them. Your partners might use them. And if they get compromised, you could be next. Plus, CISA's KEV catalog is basically a hit list for hackers—once a flaw is added, exploitation attempts skyrocket. So even if you're not directly affected, it's a good reminder to check your own defenses.
### What Should You Do Now?
First, don't panic. Panic leads to mistakes. Instead, take these steps:
- Check if you're running Collabora Online or Arista VeloCloud Orchestrator. If you are, apply the latest patches immediately.
- If you're not sure, ask your IT team. Better safe than sorry.
- Review your incident response plan. Make sure everyone knows what to do if something goes wrong.
- Keep an eye on CISA's KEV catalog. It's updated regularly and is a goldmine of actionable intel.
> "The only way to do great work is to love what you do. If you haven't found it yet, keep looking. Don't settle." – Steve Jobs. Okay, that's not security advice, but the passion part applies. Love your security posture, and don't settle for "good enough."
### The Bigger Picture
Look, security is a moving target. New vulnerabilities pop up, and attackers get craftier. But staying informed and acting fast can make all the difference. CISA's alert is a nudge—a loud one—to check your systems and make sure you're not leaving the door wide open. So take a few minutes today to verify your patches. Your future self will thank you.
And remember, if you're using antidetect browsers to manage multiple accounts or protect your privacy, keep them updated too. The same principles apply: stay vigilant, stay patched, stay safe.
