Our takeCISA added two KEV entries: CVE-2026-110447 in Collabora Online Built-in CODE Server and a critical flaw in Arista VeloCloud Orchestrator, both under active exploitation. Patch or isolate the affected systems now.Security Resilience desk
Sources (1)
- hackernews · hackernews
What this means for you — Security leader:Patch Collabora Online Built-in CODE Server (CVE-2026-110447) and Arista VeloCloud Orchestrator immediately if you self-host either; both are now in CISA KEV.
What this means for you — Lean IT orgs:If you run Collabora Online or Arista VeloCloud, update them today or turn them off from the internet — these are now actively exploited.
What this means for you — MSP:Check every client for self-hosted Collabora Online CODE Server or Arista VeloCloud Orchestrator and patch CVE-2026-110447 and the VCO flaw now; both are confirmed in CISA KEV.
What this means for you — Researcher:CISA added CVE-2026-110447 (Collabora Online) and an Arista VeloCloud Orchestrator flaw to KEV based on confirmed in-the-wild exploitation.