CISA Just Confirmed These Two Flaws Are Being Exploited Right Now
Michael Miller ·
Listen to this article~4 min
CISA added two critical vulnerabilities to its Known Exploited Vulnerabilities list, and attackers are already using them. Here's what's affected and what to do next.
You know that uneasy feeling when a security warning lands on a Friday? Yeah, that one. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) dropped two vulnerabilities into its Known Exploited Vulnerabilities (KEV) catalog, and both are already being used against real targets in the wild.
The affected software? Collabora Online's Built-in CODE Server and Arista's VeloCloud Orchestrator (VCO). Neither name sounds scary until you realize who runs them — enterprises, remote teams, and infrastructure folks who depend on them every single day.
### What CISA Actually Found
CISA doesn't add entries to the KEV list lightly. Getting on that list means there's confirmed evidence of active exploitation — not just a theoretical risk. That's the difference between "patch it when you can" and "patch it now."
Here's the first one on the docket:
- **CVE-2026-110447** — CVSS score of 9.2, which sits firmly in critical territory. This one hits Collabora Online's Built-in CODE Server, the piece that powers document editing inside web apps.
A 9.2 score isn't a gentle nudge. It's the kind of number that makes security teams cancel their afternoon plans.
### Why This Matters More Than It Sounds
Collabora Online is embedded in a lot of self-hosted productivity setups. If your organization runs an on-prem document suite, there's a decent chance CODE Server is humming along in the background somewhere. Attackers know this. That's why they're going after it.
VeloCloud Orchestrator is a different beast entirely. It's the control plane for SD-WAN deployments — the thing that tells your network how to behave. Compromise that, and someone isn't just reading your files. They're rewriting how your traffic flows.
As one security researcher put it during a similar KEV update: *"The scariest breaches don't break in. They walk through the front door using credentials you forgot to rotate."*
### The Pattern You Should Notice
Here's what bugs me about these recurring KEV additions. They keep hitting infrastructure tools — the boring, essential stuff nobody thinks about until it's on fire. Collaboration platforms. Network controllers. The glue holding remote work together.
That's not random. Attackers go where the visibility is thin and the access is broad.
### What You Should Do This Week
Don't wait for a formal advisory to reach your inbox. Take these steps:
- Check whether Collabora Online CODE Server or Arista VCO is running anywhere in your environment — including forgotten test instances.
- Apply available patches immediately, and verify the version numbers afterward.
- Review logs for unusual access patterns over the past 30 days.
- If you're running isolated browser profiles for research or multi-account work, keep them updated too. Outdated browser engines are their own quiet risk.
### The Bigger Takeaway
CISA's KEV list exists for one reason: to turn "we should probably update" into "we're updating today." Two critical flaws, both actively exploited, both sitting in software people trust.
The fix is usually simple. The cost of ignoring it isn't. Patch first, ask questions later — that's the whole game right now.
