Back to Fastnexa
Under attack?
CyberBrief
Subscribe
Fastnexa

CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud

MediumThe Hacker News · info@thehackernews.com (The Hacker News)·

At a glance

Severity
Medium
Used in attacks
Yes, 1 of 1 flaw named
Flaws named
CVE-2026-110447
Industries
Government
Reported by
1 outlet

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the wild. The critical-severity vulnerabilities are listed below - CVE-2026-110447 (CVSS score: 9.2) - An operating…

Read the full story at thehackernews.com ↗Established Source

We summarise and link; this source is not one we hold a licence to reproduce. Everything below is what CyberBrief adds: the vulnerabilities involved, whether they are being exploited, who is named, and who else covered it.

Vulnerabilities referenced

  • CVE-2026-110447Not scored yet

    Collabora Collabora Online – Built-in CODE Server

    Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.

    Used in attacks

    Added to CISA's list 2026-10-23

    Full record →

Fastnexa security experts

This story involves a flaw attackers are already using. Are you exposed?

A Fastnexa penetration tester can check whether CVE-2026-110447 or anything like it can be used against your websites, apps and network.

Book a 30-min callWhatsApp us

Think you’ve already been hit? Don’t wait on a form: call or WhatsApp +1 (732) 454 2616. We reply within 1 hour, 24/7. Emergency help →

Coverage

One outlet has carried this so far.

  1. The Hacker News ↗Established SourceFirst reported

    2026-10-24 06:25 UTC

Related stories