Awareness Lessons
3 days ago
CISA Flags Actively Exploited Flaws in Collabora Online and Arista VeloCloud
Two critical vulnerabilities in Collabora Online and Arista VeloCloud Orchestrator are being actively exploited in the wild, prompting CISA to add them to its Known Exploited Vulnerabilities (KEV) catalog. The core failure here is organizations not applying available patches before threat actors could weaponize the flaws — a recurring and preventable pattern. Network orchestration and collaboration platforms are high-value targets because they often sit at the intersection of sensitive data and broad network access. Delayed patching on internet-facing or business-critical systems creates windows of exposure that attackers are increasingly quick to exploit.
Tactical Insight
Immediate actions
- Apply vendor-issued patches for CVE-2026-110447 and the Arista VeloCloud flaw immediately, prioritizing internet-facing deployments.
- Cross-reference your asset inventory against the CISA KEV catalog now and establish an automated alert for any future KEV additions affecting your software.
Long-term improvements
- Define and enforce an SLA-based emergency patching policy (e.g., critical KEV-listed vulnerabilities patched within 24–72 hours) backed by executive sign-off.
- Maintain a continuously updated software and hardware asset inventory so patch applicability can be determined within minutes of a new advisory.
- Implement network segmentation to isolate orchestration platforms like VeloCloud from general user traffic, limiting lateral movement if exploitation occurs.
Detection measures
- Deploy continuous vulnerability scanning on all internet-facing and internally critical assets with alerting tied to CVSS score thresholds and KEV status.
- Enable detailed logging and behavioural monitoring on collaboration and network orchestration platforms to detect post-exploitation activity such as unusual API calls or privilege escalation.