CISA KEV: Collabora Online and Arista VeloCloud Actively Exploited

Sat, 24 Oct 2026 14:29:02 +0000

Engineer — Act: Both vulns are CISA KEV-listed with confirmed active exploitation; CVE-2026-110447 has a public PoC on GitHub. If you run Arista VeloCloud Orchestrator or Collabora Online Built-in CODE Server, patch immediately and check vendor advisories for fixed versions — VeloCloud is edge infrastructure where a compromise can precede full remediation.
SOC/IR — Act: Arista VeloCloud Orchestrator is an SD-WAN edge appliance; active KEV-listed exploitation means assume-breach posture is warranted — hunt for anomalous lateral movement or credential use originating from VeloCloud IPs and check CISA KEV advisory for any published IOCs or ATT&CK TTPs associated with these campaigns.
Leader — Act: Confirm whether your organization runs Arista VeloCloud or Collabora Online and verify engineering has this on a same-week remediation track; KEV-listed active exploitation on edge infrastructure can escalate to a material incident requiring disclosure, so brief your risk owner now rather than after an incident surfaces.
Signals: CVE-2026-110447 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub

Collabora-Online on CuraSec