CISA alert: two critical flaws already being exploited in Collabora and Arista

The CISA has made its move again, and this time it affects two products that many companies use without being fully aware of it. As reported by The Hacker News, the U.S. agency has added to its Known Exploited Vulnerabilities (KEV) catalog two critical-severity flaws affecting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO). The reason is no small matter: there are reports of active exploitation in the real world.

It is worth pausing on a detail that is often overlooked. A vulnerability being added to the KEV does not mean it is theoretical or that it is waiting for someone to discover it. It means there is already evidence that it is being used against real systems. And when that happens, the reaction window is measured in hours, not weeks.

What each one is and why you should care

Let's start with the first. Collabora Online is a web-based collaborative office suite, widely used in environments that opt for open alternatives to cloud suites. Its Built-in CODE Server is the component that allows documents to be edited directly from the browser. In other words, we are not talking about just any auxiliary server: we are talking about the piece that manages the organization's document editing. A critical flaw there can translate into access to documents, content manipulation, or code execution on the server.

The second affects Arista VeloCloud Orchestrator, the SD-WAN network management console. These types of platforms control connectivity between sites, branches, and the cloud. If an attacker compromises the orchestrator, they don't just get into a server: they can alter routing, intercept traffic, or knock out the entire company's network. For an SMB with several offices or with remote work, the potential impact is enormous.

The news identifies the Collabora flaw with a CVSS score of 9.2, within the critical range. This is not a notice to take calmly.

The pattern repeats: the exposure window is narrowing

If you follow this blog fairly regularly, this will sound familiar. We recently commented in PHP2Shell: AI accelerates the patch race and SMBs fall behind that attackers are drastically reducing the time between the publication of a flaw and its mass exploitation. The Wasmtime case was another example of how apparently invisible infrastructure components become entry points.

The conclusion is uncomfortable but necessary: the "we'll patch it in the next maintenance" approach no longer works. When CISA adds a vulnerability to the KEV, it is implicitly saying that action must be taken now. And if your IT team does not have a clear inventory of which versions of Collabora or VeloCloud Orchestrator are running in your infrastructure, the problem is not the patch: it is that you don't know where to apply it.

What we recommend at ForgeNEX

We are not going to invent deadlines or promise magic solutions. What we can do is organize the work with practical judgment:

1. Locate the affected systems. Check whether you have Collabora Online deployed with the integrated CODE Server or Arista VeloCloud Orchestrator. If the answer is yes, this is priority one.
2. Check the exact version. Without a version, no patch is possible. Document which build is in production and in which test environments.
3. Apply the vendor updates as soon as possible. Collabora and Arista publish their own advisories; follow their official channels and do not trust third-party patches.
4. Review internet exposure. If the CODE Server or the orchestrator are accessible from outside without need, close that off. Segment and limit access to the bare minimum necessary.
5. Look for signs of compromise. Review access logs, accounts created without justification, configuration changes, or anomalous traffic on the managed network.
6. Activate a response plan. If you detect anything unusual, isolate the system, preserve evidence, and do not improvise.

A note on the context. Collaboration tools and network consoles are two of the most sensitive assets of any SMB: one concentrates information and the other controls how it flows. Attackers know this. That is why flaws in these products do not stay in the "we'll look at it later" drawer.

The useful question is not whether you will be attacked, but whether you would know how to detect it and respond in less than 24 hours.

At ForgeNEX we work with SMBs that do not have a dedicated cybersecurity department and that need to turn this type of alert into concrete actions. If you want to review how your infrastructure stands against this type of vulnerability, this is a good time to do so. And if your team is already involved in AI automation projects, such as those we cover in Process automation with n8n and AI for companies, remember that every integration adds attack surface: security cannot be separate from the project.

Source: The Hacker News. Analysis and adaptation: ForgeNEX.