CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud

The US Cybersecurity and Infrastructure Security Agency has added two vulnerabilities to its list of known exploited vulnerabilities, citing active exploitation. These vulnerabilities affect Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator. One of the vulnerabilities, CVE-2026-110447, has a CVSS score of 9.2, indicating a critical severity level. The vulnerabilities are being actively exploited in the wild, according to reports. The agency's addition of these vulnerabilities to its list suggests that they are being targeted by attackers. The affected products are Collabora Online and Arista VeloCloud Orchestrator.