[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fzQqDzsQmOK2XnUm_TEnt8WocJ-PaG_JvOvZlzuORg6c":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"9b482e47-2735-4fab-a5fb-ef6f66589bdc","cisa-flags-actively-exploited-flaws-in-collabora-online-and-arista-velocloud","754a4a85-2855-4a22-a5f6-e5d796fb04ef","CISA Flags Actively Exploited Flaws in Collabora Online and Arista VeloCloud","Two critical vulnerabilities in Collabora Online and Arista VeloCloud Orchestrator are being actively exploited in the wild, prompting CISA to add them to its Known Exploited Vulnerabilities (KEV) catalog. The core failure here is organizations not applying available patches before threat actors could weaponize the flaws — a recurring and preventable pattern. Network orchestration and collaboration platforms are high-value targets because they often sit at the intersection of sensitive data and broad network access. Delayed patching on internet-facing or business-critical systems creates windows of exposure that attackers are increasingly quick to exploit.","**Immediate actions:**\n- Apply vendor-issued patches for CVE-2026-110447 and the Arista VeloCloud flaw immediately, prioritizing internet-facing deployments.\n- Cross-reference your asset inventory against the CISA KEV catalog now and establish an automated alert for any future KEV additions affecting your software.\n\n**Long-term improvements:**\n- Define and enforce an SLA-based emergency patching policy (e.g., critical KEV-listed vulnerabilities patched within 24–72 hours) backed by executive sign-off.\n- Maintain a continuously updated software and hardware asset inventory so patch applicability can be determined within minutes of a new advisory.\n- Implement network segmentation to isolate orchestration platforms like VeloCloud from general user traffic, limiting lateral movement if exploitation occurs.\n\n**Detection measures:**\n- Deploy continuous vulnerability scanning on all internet-facing and internally critical assets with alerting tied to CVSS score thresholds and KEV status.\n- Enable detailed logging and behavioural monitoring on collaboration and network orchestration platforms to detect post-exploitation activity such as unusual API calls or privilege escalation.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":20,"PCI DSS Requirement 6":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"OWASP A06:2021 Vulnerable and Outdated Components":23,"CIS Control 7: Continuous Vulnerability Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 mandates that operators of essential and important entities handle incidents and apply security patches as part of their baseline security obligations, making delayed patching a potential compliance violation.","Requirement 6 mandates that organizations protect systems and software from known vulnerabilities by installing applicable security patches in a timely manner, which would have directly mitigated exposure here.","SI-2 requires organizations to identify, report, and correct information system flaws promptly; adherence would have mandated rapid patching once CISA flagged these vulnerabilities.","Running unpatched versions of Collabora Online and Arista VeloCloud Orchestrator is a textbook instance of the risk OWASP A06 warns against — using components with known, exploitable vulnerabilities.","Regular, automated vulnerability scanning and a defined remediation timeline would have ensured patches for these critical flaws were applied before active exploitation began.","This control explicitly requires timely identification and remediation of technical vulnerabilities, directly addressing the failure to patch Collabora Online and Arista VeloCloud before exploitation.","Restricting access to vulnerable orchestration platforms like VeloCloud to authenticated, authorised users only would have reduced the attack surface available to threat actors exploiting these flaws.","published","2026-10-24T08:21:11.096862+00:00","2026-10-24T08:21:11.062+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fcisa-flags-two-actively-exploited.html","cisa-flags-two-actively-exploited-critical-flaws-in-collabora-online-and-arista-ad7396","CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":42,"name":43,"slug":44,"description":45,"color":46},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[49,52,55],{"slug":38,"name":50,"problem":51},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":44,"name":53,"problem":54},"Automated patch management","Known holes get closed in days, not months.",{"slug":56,"name":57,"problem":58},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them."]