CISA Warns of Actively Exploited Critical Vulnerabilities in Collabora Online and Arista VeloCloud

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities, CVE-2026-110447 in Collabora Online and CVE-2026-114625 in Arista VeloCloud Orchestrator, to its Known Exploited Vulnerabilities catalog. These flaws, an OS command injection and an SQL injection respectively, are being actively exploited, allowing remote code execution or privileged access. Federal agencies are mandated to apply patches by October 26, 2026.