CISA Adds Collabora Online and Arista VeloCloud Flaws to Actively Exploited List

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced on Friday that two critical vulnerabilities—one in Collabora Online's built‑in CODE server and another in Arista Networks' VeloCloud Orchestrator (VCO)—have been moved to its Known Exploited Vulnerabilities (KEV) catalog after evidence of active attacks surfaced.

Collabora Online, an open‑source office suite often embedded in cloud‑based collaboration platforms, relies on the CODE server to render documents in real time. Security researchers have identified a flaw that allows unauthenticated actors to execute arbitrary code on affected systems, potentially giving them full control over the host environment. The agency’s notice indicates that threat actors are already leveraging the defect in the wild, prompting an urgent call for remediation.

Arista's VeloCloud Orchestrator, the management component of the company's software‑defined wide‑area networking (SD‑WAN) solution, also harbors a critical issue. The vulnerability, described as allowing remote code execution through crafted network traffic, has been observed in active exploit campaigns targeting organizations that rely on VCO for centralized network policy enforcement. Because SD‑WAN deployments often span multiple sites, a successful breach could cascade across an enterprise’s entire network fabric.

CISA’s KEV program is designed to highlight vulnerabilities that pose the greatest immediate risk to U.S. critical infrastructure and the broader public‑private sector. By flagging these two flaws, the agency is urging federal and private entities to prioritize patching, apply any available mitigations, and monitor for signs of compromise. Both vendors have released security advisories and are working with customers to roll out fixes, but the agency notes that many installations remain unpatched, leaving them exposed.

Industry observers say the addition of these entries underscores a growing trend: threat actors are shifting focus toward exploiting known, high‑severity bugs before organizations can fully remediate them. The public disclosure also serves as a reminder that even widely used, ostensibly mature platforms can harbor serious weaknesses. Organizations are advised to review their asset inventories, verify that the latest patches for Collabora Online and VeloCloud Orchestrator are applied, and consider compensating controls such as network segmentation and intrusion detection while updates are deployed.

Looking ahead, CISA plans to continue monitoring exploitation activity and will update the KEV list as new evidence emerges. Both Collabora and Arista have pledged to improve their vulnerability disclosure processes and accelerate patch delivery. Security professionals stress that timely patch management, combined with robust threat‑hunting practices, remains the most effective defense against the kind of active exploitation highlighted in the agency’s latest alert.