[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ffF6qWvvyXlIT6hUsStOeTvjjr8lZ-quGpYHJNnS-Lrg":3},{"article":4,"iocs":50,"watch_terms":55,"solutions":56,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"754a4a85-2855-4a22-a5f6-e5d796fb04ef","CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud","cisa-flags-two-actively-exploited-critical-flaws-in-collabora-online-and-arista-ad7396","The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the wild. The critical-severity vulnerabilities are listed below - CVE-2026-110447 (CVSS score: 9.2) - An operating","CISA has identified two critical vulnerabilities, CVE-2026-110447 and CVE-2026-110447, impacting Collabora Online and Arista VeloCloud Orchestrator, respectively. Both flaws are being actively exploited in the wild, prompting CISA to add them to its Known Exploited Vulnerabilities (KEV) catalog. Organizations using these products are urged to apply patches immediately to mitigate potential risks.","CISA adds two critical, actively exploited vulnerabilities in Collabora Online and Arista VeloCloud to its KEV list.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fcisa-flags-two-actively-exploited.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhmm0pKX3kbfMC2GKemUiMT8PH1uDJIHn4AcmoiQ5nUK4TWZl0Ni_-k6kjpAFUrFzEWSSq_G307YJXTXmn9FZ7q6oOr5OEMASP9mrXOXrk9lSOGzqPCAbkQqpHsMxFe1q5CnyDZnqeDq_FiiC7jEzp0ie1r_nnQOSKcbPcKBdoXI-ycAjCZA9AuxemUhE5k\u002Fs1600\u002Farista-cisa.jpg","2026-10-24T06:25:57+00:00","2026-10-24T08:00:24.876598+00:00",9,[17,20,22,25],{"name":18,"type":19},"Collabora Online Built-in CODE Server","product",{"name":21,"type":19},"Arista VeloCloud Orchestrator",{"name":23,"type":24},"CISA","vendor",{"name":26,"type":24},"Arista","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":27,"icon":29,"name":30,"slug":31},null,"Vulnerabilities","vulnerabilities",[33,38,43,45],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":44},{"id":27,"icon":29,"name":30,"slug":31},{"category":46},{"id":47,"icon":29,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51],{"type":52,"value":53,"context":54},"cve","CVE-2026-110447","Critical vulnerability in Collabora Online Built-in CODE Server",[23,26,18],{"controls":57,"vendors":137},[58,87,112],{"slug":59,"name":60,"problem":61,"products":62},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":88,"name":89,"problem":90,"products":91},"patch-management","Automated patch management","Known holes get closed in days, not months.",[92,100,104],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":88,"product_name":101,"url":102,"description":103},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":49,"name":113,"problem":114,"products":115},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[116,124,132],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":133,"product_name":134,"url":135,"description":136},"dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",[],{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":150},"cisa-flags-actively-exploited-flaws-in-collabora-online-and-arista-velocloud","CISA Flags Actively Exploited Flaws in Collabora Online and Arista VeloCloud","Two critical vulnerabilities in Collabora Online and Arista VeloCloud Orchestrator are being actively exploited in the wild, prompting CISA to add them to its Known Exploited Vulnerabilities (KEV) catalog. The core failure here is organizations not applying available patches before threat actors could weaponize the flaws — a recurring and preventable pattern. Network orchestration and collaboration platforms are high-value targets because they often sit at the intersection of sensitive data and broad network access. Delayed patching on internet-facing or business-critical systems creates windows of exposure that attackers are increasingly quick to exploit.",[143,144,145,146,147,148,149],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":151,"PCI DSS Requirement 6":152,"NIST SP 800-53 SI-2: Flaw Remediation":153,"OWASP A06:2021 Vulnerable and Outdated Components":154,"CIS Control 7: Continuous Vulnerability Management":155,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":156,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":157},"NIS2 mandates that operators of essential and important entities handle incidents and apply security patches as part of their baseline security obligations, making delayed patching a potential compliance violation.","Requirement 6 mandates that organizations protect systems and software from known vulnerabilities by installing applicable security patches in a timely manner, which would have directly mitigated exposure here.","SI-2 requires organizations to identify, report, and correct information system flaws promptly; adherence would have mandated rapid patching once CISA flagged these vulnerabilities.","Running unpatched versions of Collabora Online and Arista VeloCloud Orchestrator is a textbook instance of the risk OWASP A06 warns against — using components with known, exploitable vulnerabilities.","Regular, automated vulnerability scanning and a defined remediation timeline would have ensured patches for these critical flaws were applied before active exploitation began.","This control explicitly requires timely identification and remediation of technical vulnerabilities, directly addressing the failure to patch Collabora Online and Arista VeloCloud before exploitation.","Restricting access to vulnerable orchestration platforms like VeloCloud to authenticated, authorised users only would have reduced the attack surface available to threat actors exploiting these flaws."]