CISA Adds Two Actively Exploited Critical Flaws to KEV

Introduction

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) catalog with two new entries that are already being abused in the wild. The additions affect the Collabora Online Built‑in CODE Server and the Arista VeloCloud Orchestrator (VCO). Both flaws carry critical severity ratings and demand immediate attention from any organization running the affected software.

CISA Updates Its Known Exploited Vulnerabilities Catalog

On Friday CISA announced that it had placed two vulnerabilities onto the KEV list, a move that signals confirmed exploitation activity. The agency’s practice is to add only those weaknesses for which there is credible evidence of active abuse, making this update a clear indicator that threat actors are leveraging these flaws right now. Organizations that maintain the KEV as part of their vulnerability management workflow should treat these entries as top‑priority remediation items.

Collabora Online Built‑in CODE Server Flaw

The first vulnerability is tracked as CVE-2026-110447 and carries a CVSS base score of 9.2, placing it firmly in the critical band. Public details describe an operating‑system‑level issue in the built‑in CODE server component that could allow an unauthenticated attacker to execute arbitrary code. Because Collabora Online is widely deployed for collaborative document editing in both on‑premises and cloud environments, the potential attack surface is large. At the time of writing, the vendor has not released a full advisory, but the KEV inclusion implies that a patch or mitigation is either available or imminent.

Arista VeloCloud Orchestrator Vulnerability

The second entry concerns the Arista VeloCloud Orchestrator, a management platform for SD‑WAN deployments. CISA has not yet disclosed the CVE identifier, CVSS score, or technical specifics for this flaw. The absence of public details suggests that the vendor may still be coordinating a disclosure timeline. Nevertheless, the KEV listing confirms that exploitation has been observed, so any VCO instance should be considered compromised until a vendor‑supplied fix is applied.

Why This Matters for Security Teams

Both affected products sit in critical infrastructure pathways. Collabora Online often handles sensitive document content, while VeloCloud Orchestrator controls network traffic routing for branch offices and remote sites. An attacker who gains code execution on either platform can pivot to deeper network segments, exfiltrate data, or disrupt communications. The KEV designation elevates these vulnerabilities above typical patch cycles; they require emergency change‑control procedures, out‑of‑band patching, and verification that compensating controls such as network segmentation and intrusion detection are functioning.

Recommended Mitigation Steps

• Identify every instance of Collabora Online Built‑in CODE Server and Arista VeloCloud Orchestrator in the asset inventory.
• Check vendor security advisories for the latest patches; apply them immediately using a tested change‑management process.
• If patches are not yet available, implement network‑level restrictions: limit inbound access to the management interfaces, enforce strong authentication, and enable logging of all administrative actions.
• Run targeted vulnerability scans to confirm that the specific CVE identifiers are no longer detectable after remediation.
• Update the organization’s KEV tracking dashboard and communicate the status to stakeholders, including any regulatory bodies that require proof of timely remediation.

Conclusion

CISA’s latest KEV additions serve as a stark reminder that even well‑maintained enterprise software can become a vector for rapid compromise when critical flaws are weaponized. Security teams must act swiftly, applying vendor patches, hardening network access, and validating remediation through automated scanning. Grivyonx’s AI‑driven DevSecOps and cloud security services can help organizations streamline this response cycle and maintain continuous compliance.