CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud

CISA has added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation in the wild. The affected products are Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO). One of the listed vulnerabilities is CVE-2026-110447 with a CVSS score of 9.2. Both flaws are classified as critical severity. The advisory highlights the urgency for organizations using these products to apply mitigations or patches promptly. Active exploitation has been reported, increasing the risk to enterprise and network infrastructure environments. CISA's KEV listing signals that federal agencies and critical infrastructure operators should prioritize remediation. Details on the second vulnerability were not fully disclosed in the available content.