thehackernews.com
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
The U.S. Cybersecurity and Infrastructure Security Agency added two critical vulnerabilities to its Known Exploited Vulnerabilities list: CVE‑2026‑110447 in Collabora Online’s CODE Server and CVE‑2026‑114625 in Arista VeloCloud Orchestrator. Reports show active exploitation, with attackers using the Collabora flaw to install web shells on Nextcloud servers for credential and wallet reconnaissance. The Arista flaw requires network access and an authenticated session, with attackers identified from two Japanese IPs. Federal agencies must patch by October 26, 2026.