CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud

Two critical vulnerabilities in Collabora Online and Arista VeloCloud Orchestrator are being actively exploited in the wild, prompting CISA to add them to its Known Exploited Vulnerabilities (KEV) catalog. The core failure here is organizations not applying available patches before threat actors could weaponize the flaws — a recurring and preventable pattern. Network orchestration and collaboration platforms are high-value targets because they often sit at the intersection of sensitive data and broad network access. Delayed patching on internet-facing or business-critical systems creates windows of exposure that attackers are increasingly quick to exploit.