Critical KEV Additions: Collabora Online CODE Server & Arista VeloCloud Orchestrator Vulnerabilities (CVE‑2026‑110447)
What It Is – CISA placed two critical‑severity flaws affecting Collabora Online’s built‑in CODE Server and Arista VeloCloud Orchestrator (VCO) on its Known Exploited Vulnerabilities (KEV) list. Both CVEs have a CVSS 9.2 score and are reported to be actively exploited in the wild.
Exploitability – Active exploitation confirmed by multiple threat‑intel feeds; proof‑of‑concept code has been observed in the wild. No public patches were available at the time of the advisory.
Affected Products –
- Collabora Online – Built‑in CODE Server (document‑editing backend).
- Arista Networks – VeloCloud Orchestrator (SD‑WAN management platform).
Why It Matters for Trust & Control Assurance
- Third‑party component visibility – Continuous monitoring of vendor‑supplied code is a core control for demonstrating due‑diligence in supply‑chain risk programs.
- Patch‑management evidence – Maintaining auditable records that critical patches are applied promptly satisfies a common control objective across SOC 2, ISO 27001, and NIST CSF.
- Incident‑response readiness – Knowing that a vendor’s product is under active exploitation forces organizations to validate their detection and containment playbooks, reinforcing a defensible audit trail.
Recommended Actions
- Inventory all instances of Collabora Online CODE Server and Arista VeloCloud Orchestrator in your environment.
- Validate whether patches or mitigations have been released; apply them immediately.
- Enrich your third‑party risk register with the KEV status and set up continuous vulnerability feeds for these vendors.
- Test detection rules for the known exploit behaviors and update incident‑response runbooks accordingly.
Source: The Hacker News – CISA Flags Two Actively Exploited Critical Flaws