CISA, the U.S. Cybersecurity and Infrastructure Security Agency, has added two critical vulnerabilities affecting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV) catalog. Inclusion in the KEV list means CISA says there are reports of active exploitation in the wild, making these flaws more urgent than vulnerabilities that are only theoretical or have no known attacks.

What happened

According to the source report, the newly listed vulnerabilities affect Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator. CISA’s KEV catalog is widely followed by security teams because it highlights vulnerabilities that attackers are reportedly already using.

Based on the source provided, one of the vulnerabilities is identified as CVE-2026-110447 with a CVSS score of 9.2. The source excerpt provided here is incomplete, so technical details, affected versions and vendor remediation guidance should be confirmed directly with the relevant vendor advisories and CISA’s KEV entry before making operational decisions.

Why it matters for European businesses

For European organisations, a KEV listing is a practical signal to prioritise validation and remediation. Businesses do not need to be based in the U.S. to be affected: if they use the impacted software in their own environment, through a hosting provider, or via a managed service, they may still face real risk.

Collaboration platforms and network orchestration systems can be high-value targets because they may sit close to business documents, user sessions, administrative controls or core connectivity. If a vulnerability in such systems is actively exploited, attackers may use it to gain unauthorised access, disrupt operations, move laterally inside a network, or target downstream customers and users.

This is especially relevant for SMEs that rely on external IT providers and SaaS-style infrastructure, where software components may not always be visible to internal teams. In such cases, a public warning about active exploitation should trigger supplier checks as well as internal patching reviews.

Who may be affected

• IT and security teams responsible for patching, exposure management and vulnerability prioritisation.
• Businesses using Collabora Online for document collaboration, including deployments integrated into private cloud or self-hosted environments.
• Organisations using Arista VeloCloud for SD-WAN or branch connectivity, including multi-site companies and distributed retail or logistics operations.
• Managed service providers and digital agencies operating hosted platforms or network infrastructure for clients.
• Regulated businesses that must demonstrate timely risk treatment, especially where critical digital services or supplier security controls are in scope.

What companies should consider

• Confirm exposure quickly. Identify whether your organisation or service providers use affected Collabora Online or Arista VeloCloud components.
• Check official advisories. Review vendor security bulletins and CISA’s KEV entry for confirmed affected versions, mitigations and patch availability.
• Prioritise remediation. If your environment is affected, treat these vulnerabilities as high priority because active exploitation has been reported.
• Review internet exposure. Determine whether management interfaces or collaboration services are directly accessible from the internet and reduce exposure where possible.
• Look for signs of compromise. Where feasible, inspect logs, administrative activity and unusual access patterns, especially on systems that are externally reachable.
• Engage suppliers. If the software is managed by a hosting provider, MSP or network partner, request confirmation of patch status and any compromise checks performed.
• Update risk processes. Use KEV-listed issues to refine vulnerability triage so actively exploited flaws are escalated faster than lower-risk backlog items.

At this stage, the most important point for business readers is not the U.S. origin of the alert, but the operational significance of a KEV listing. When a vulnerability moves from “serious” to “actively exploited,” European companies should assume a shorter response window and verify both their own systems and key suppliers without delay.