Friday morning, a federal admin hit refresh on CISA’s Known Exploited Vulnerabilities catalog and watched two names appear that never make the Monday patch call. Collabora Online’s built-in CODE server. Arista’s VeloCloud Orchestrator. CISA says both are already being exploited in the wild. One catalog entry, CVE-2026-110447, is scored 9.2. That’s the moment your cybersecurity inventory either includes the helper daemons, or you find out the hard way that it doesn’t.

You’ve seen CODE as a convenience. Upload a spreadsheet, the browser renders it, nobody installs Office on a lab PC. VeloCloud is the other quiet box: the SD-WAN orchestrator that tells every branch which tunnel to build. The software you deployed once, labeled “platform,” and left off the emergency list now carries a federal exploitation stamp.

CODE Was Never Just a Preview Feature

Collabora Online Development Edition, the “built-in CODE server” in a lot of Nextcloud and ownCloud stacks, is a LibreOffice-based converter sitting behind your files app. Users think they clicked preview. The host launched a document engine, parsed untrusted bytes, and painted HTML. That engine has the same appetite as any office parser you’d never expose on purpose: macros, embedded objects, malformed OLE, fonts that lie about their size.

Internet exposure is the usual surprise. CODE often listens on localhost while the portal reverse-proxies /cool or /lool from the public site. Your network diagram shows one Nextcloud VM. The attack surface is the portal plus a full document runtime. Security hardening that patches Nextcloud and ignores the bundled CODE package leaves the converter on last quarter’s build. CMDB entries named “files” or “intranet” won’t light up when CISA types Collabora.

Hunt the aliases before you hunt the CVE. Look for collabora, code, richdocuments, coolwsd, and any container that still ships CODE next to the groupware image. Check whether anonymous users can force a conversion, whether the worker runs as the portal user, and whether it can reach metadata stores and object buckets. If a student homework upload can tickle the same process that holds your admin session cookies, you already have a problem CISA merely documented.

The Orchestrator Outranks Every Branch Firewall

VeloCloud Orchestrator, VCO in the tickets, is the brain of an Arista SD-WAN fabric. Edges at retail sites, clinics, and warehouses phone home for policy. Compromise the orchestrator and you own every edge that phones home: routes, certificates, DNS hijacks, and the quiet ability to slide a collector onto a segment that never hits the corporate firewall.

Plenty of VCO consoles were put on the internet so a partner or NOC could work without a jump box. Plenty more sit on a “management VLAN” that still allows password logins from the whole campus. Brute-force against that UI is undignified, and it still works when lockout is off and MFA is a slide in last year’s roadmap. Threat detection that only watches branch tunnels will miss an admin API session that pushes a new device profile at 2 a.m.

This is a bad look for programs that treat SD-WAN as a circuit invoice. The orchestrator is the signing authority for every edge. It stores the trust that makes the next config look legitimate. Defense in depth here means the console is reachable from a named jump path, with phishing-resistant MFA, and with change-control that can explain every policy push. If you can’t produce that path from memory, assume CISA’s “active exploitation” line already applies to someone who found yours.

Treat KEV Middleware Like Production Cybersecurity

Start this afternoon with an inventory that uses the product names CISA printed, not the nicknames on your diagrams. List every Collabora CODE or Collabora Online instance, including the “built-in” Nextcloud app and any standalone converter VM. List every VeloCloud Orchestrator, including lab and DR. For each, write three facts: version, who can reach the UI or conversion URL from off-box, and whether a vendor patch for the KEV items is already installed. If you can’t answer in an hour, that’s the finding.

Immediate containment is ugly, and it’s cheaper than incident response after a converter shells out. If CODE can’t be patched today, disable in-browser editing and fall back to download-and-open. Kill anonymous conversion. Run the worker as an unprivileged user with no cloud keys and no SSH to anything. If VCO can’t be patched today, pull it off the internet, require a jump host, rotate orchestrator passwords and API tokens, and freeze config pushes except through a monitored change window. Threat-protection rules on the portal help only after the engine is patched or taken offline.

Hunt as if the catalog note is already true in your tenant. On document hosts, look for coolwsd or soffice children spawning shells, unexpected outbound connections during a conversion, and new files under the converter’s cache directories. On the orchestrator, look for new admin users, API tokens issued outside business hours, and edge profile changes that add routes or certificates nobody requested. Feed those into the same incident response queue you use for a mail-gateway breach. A “maybe it’s a glitch” ticket is how these linger.

Ongoing work is a mapping problem. Subscribe to the KEV feed and alias Collabora, CODE, richdocuments, VeloCloud, and VCO to the CI records your patch tool actually scans. Put converters and WAN orchestrators on the same SLA as internet-facing apps. That’s how cyber security earns the name: the unglamorous processes get the same clock as the logo products. Keep the document worker in a jailed process with no secrets, no SMTP, and no path to your identity provider. Keep the orchestrator behind client certificates and an allow list of jump hosts. Log every conversion and every policy push someplace threat detection actually reads, and alert on admin creation the way you alert on domain-admin changes. Rehearse the day you revoke every edge cert because VCO lied to you. Schedule that drill twice a year, with the network team in the room, before CISA has to remind you again.

Sources

• CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud