CISA KEV adds Collabora Online and Arista VeloCloud bug
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Know
What Happened
CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on Friday, confirming that attackers are exploiting both in live campaigns. The first affects Collabora Online’s Built-in CODE Server, the containerized document-editing backend embedded in many self-hosted Nextcloud and ownCloud deployments. The second affects Arista’s VeloCloud Orchestrator (VCO), the management plane for SD-WAN fleets. The Collabora flaw carries CVE-2026-110447; CISA’s KEV entry obligates U.S. federal agencies to remediate on a compressed deadline and signals to the broader market that exploitation is real, not theoretical.
Why It Matters
Both products sit in privileged positions. The Collabora CODE Server handles document rendering for collaboration platforms, which means it parses untrusted files and speaks directly to storage backends. VeloCloud Orchestrator, meanwhile, is the control point for enterprise WAN routing across branch sites. Compromise of either yields high-value access: the first to file stores and user sessions, the second to network fabric and traffic paths. That combination is attractive to both espionage actors and ransomware operators staging lateral movement.
Technical Details
CVE-2026-110447 is a remote code execution issue in the CODE Server. The attack surface is the document conversion and rendering pipeline, where crafted office files or API requests reach a service running with the web server’s privileges. Because CODE Server frequently runs in Docker adjacent to Nextcloud, a successful exploit can pivot into the host’s mounted volumes. We have detailed exploitation indicators in our advisory on Collabora Online CODE Server RCE actively exploited (CVE-2026-110447).
The Arista VCO flaw exposes the orchestrator’s management API, allowing authenticated or crafted requests to execute commands on the appliance. Organizations should review VCO audit logs for unusual API calls from unexpected source addresses and check for unauthorized admin account creation.
Indicators to hunt for: anomalous coolwsd child processes spawning shells, outbound connections from CODE containers, and unexpected VCO API tokens or new operator accounts.
Immediate Risk
Any internet-facing CODE Server or VCO instance is at elevated risk right now. Self-hosted Collabora deployments are especially exposed because many administrators run them without a WAF, treating document editing as internal tooling. Federal civilian agencies face binding remediation timelines; private-sector defenders should treat the KEV listing as an implicit “exploited in the wild” confirmation and prioritize patching within days, not weeks. Inventory both products first - shadow deployments in subsidiary or lab environments are common and frequently missed.
Security Insight
The pairing here is instructive: one vulnerability lives in a document editor, the other in a network orchestrator. Attackers increasingly chain exactly this profile - a file-parsing foothold on the collaboration tier, then abuse of management-plane credentials to move across the WAN. Historical precedent is the 2023 exploitation of MOVEit and the later targeting of SD-WAN management interfaces, where initial access came from application bugs but the damage came from control-plane reach. The defensive takeaway is to segment CODE Server containers from the network management plane entirely, so that a document-rendering compromise cannot descend into orchestrator credentials sitting in the same trust zone.
Further Reading
Never miss a security update
Get real-time security alerts delivered to your preferred platform.
Related News
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including four vulnerabilities impacting Pl
Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners. The vuln
Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. [...]
A critical vulnerability (CVE-2026-21589) affecting multiple Atlassian product families, including Jira, Confluence, and Bitbucket, is being exploited in attacks that do not require authentication. [.