CISA Flags Critical Actively Exploited Flaws in Collabora Online CODE Server and Arista VeloCloud Orchestrator (CVE‑2026‑110447)
CISA placed two critical‑severity CVEs affecting Collabora Online’s CODE Server and Arista VeloCloud Orchestrator on its Known Exploited Vulnerabilities list, citing active exploitation. Enterprises must verify patch status and strengthen third‑party risk monitoring to maintain audit‑ready control assurance.
ADTP Breach Watch· October 24, 2026· The Hacker News
SeverityCritical
Type☁️ Vulnerability
ConfidenceHigh
ReportedOct 24, 2026
TECH_SAASTELCOVulnerability Exploit
What happened
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE‑2026‑110447 (CVSS 9.2) for Collabora Online’s built‑in CODE Server and a separate critical flaw in Arista VeloCloud Orchestrator to its KEV program, indicating that threat actors are exploiting these weaknesses in the wild.
Why it matters for trust and compliance
These active exploits highlight the need for continuous third‑party risk monitoring and auditable patch‑management evidence—control objectives that map to multiple frameworks and underpin a defensible trust posture.
Continuous monitoring of vendor‑supplied components provides real‑time evidence of due‑diligence.
Documented patch‑management actions create a defensible audit trail for compliance reviews.
Who is affected
TECH_SAASTELCO
Recommended actions
Create an inventory of all Collabora Online CODE Server and Arista VeloCloud Orchestrator deployments.
Apply any available patches or mitigations immediately.
Integrate CISA KEV feeds into your third‑party risk platform for ongoing visibility.
Update detection rules and incident‑response playbooks to cover the known exploit behaviors.
Details
CVEs
CVE-2026-110447
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.