{
  "id": 16301735,
  "title": "CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud",
  "url": "https://urgent.news/2026/10/24/cisa-flags-two-actively-exploited-critical-flaws-in-collabora-online",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-24T06:25:57.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html"
  },
  "original_language": "en",
  "account": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently listed two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) in its Known Exploited Vulnerabilities (KEV) due to evidence of active exploitation. These critical-severity issues, identified as CVE-2026-110447 and CVE-2026-114625, are being actively exploited by threat actors.\n\nCVE-2026-110447 allows for backdoor creation on Nextcloud servers, enabling reconnaissance and discovery of sensitive data such as credential stores, password manager artifacts, and cryptocurrency wallets. On the other hand, CVE-2026-114625 requires network access to the VCO web interface and a valid authenticated session, as well as an Enterprise Read Only user role.\n\nWhile Arista has acknowledged the active exploitation of CVE-2026-114625, the company has not disclosed the specific methods used by attackers following privilege escalation, nor the number of organizations affected. The two IP addresses associated with Japan have been identified as responsible for the activity.\n\nFederal Civilian Executive Branch (FCEB) agencies are advised to apply the necessary fixes by October 26, 2026, to secure their networks. This ongoing issue highlights the importance of addressing critical vulnerabilities promptly to prevent potential breaches and data theft.",
  "summary": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the wild. The critical-severity vulnerabilities are listed below - CVE-2026-110447 (CVSS score: 9.2) - An operating",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}