The US agency CISA added two critical software vulnerabilities to its catalog of confirmed-exploited flaws, The Hacker News reported in an article dated October 24, 2026. CISA is a United States agency, but that says nothing about where the exploitation occurred: the source does not specify where it was observed. The addition is based on active-exploitation reports, made on a Friday according to the outlet.
Key points
- CISA added two critical vulnerabilities to its catalog of confirmed-exploited flaws.
- The affected products are Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator, according to The Hacker News.
- Any SMB using these tools should ask its IT provider to apply the patches without delay.
What we know about the incident
This isn’t a single-victim story but a general alert. The Hacker News reported, on October 24, 2026, that CISA added two critical vulnerabilities to its catalog. The source does not specify where exploitation occurred or which industries were affected.
The two products named by the source are an online office suite and a multisite network management tool. The Hacker News rates both flaws as critical severity and attributes a CVSS score of 9.2 out of 10 to the first, tracked as CVE-2026-110447.
CISA’s catalog serves as a reference well beyond US borders. We stick to what the source establishes: the flaws are rated critical, and reports indicate they are already being exploited. The industry of the affected organizations is not specified.
Critical software vulnerabilities also affect SMBs here
Exploitation can target a specific organization, but a large share of attempts come from automated campaigns that scan the internet for accessible, outdated services. A small business running a vulnerable product can be exposed too, even if it was never targeted by name.
The general mechanism is well understood. A vendor releases a patch, the flaw becomes public, and automated scans then search for installations that haven’t been updated. A hosted office suite holds contracts and sometimes personal information. A network tool controls connectivity between your sites. The Canadian Centre for Cyber Security lists prompt patching among its baseline controls for small organizations.
The cost isn’t measured in IT expenses. It’s measured in lost production days and clients who start to doubt. There is no absolute protection: be wary of anyone who promises zero risk.
Checks to run this week
The useful work comes down to a few simple steps, no special tooling required. You need to know which software is exposed to the internet, confirm the vendor’s patches are installed, and assign someone to monitor public advisories. These checks substantially reduce exposure, without guaranteeing anything.
- Ask your IT provider for a list of software and equipment accessible from the internet.
- Get written confirmation that vendor patches are installed on those systems.
- Have management designate who will read advisories from the Canadian Centre for Cyber Security.
FAQ
How can I tell if my business uses one of the affected products
Start with the inventory, not the technical details. Ask your IT provider whether they’ve deployed a collaborative office tool or a multisite network manager at your organization, and under what product name. If they manage your servers, they should be able to answer quickly. If no one keeps this inventory, that’s the first project to tackle: you can’t protect a fleet of systems you don’t know you have.
Would a real attacker actually be interested in a fifteen-employee SMB
Some attacks target a chosen victim, but automated campaigns exploiting a published flaw are mainly looking for a reachable address and unpatched software. Canadian organizations of every size fall within that net, including the smallest ones. An SMB can also prove more fragile, having fewer staff to monitor advisories and less room to absorb a service outage.
Should updates be applied right away even at the risk of disrupting work
A patch that closes an already-exploited flaw should be treated as a priority. Your provider should run two separate tracks: urgent updates, applied as soon as possible after a quick test, and routine ones, scheduled outside service hours. We set no universal timeline here, because the right call depends on the system’s role in your operations.
Sources
- The Hacker News · press, October 24, 2026
- CISA, Known Exploited Vulnerabilities Catalog · confirmed-exploited vulnerabilities
- Canadian Centre for Cyber Security: baseline cyber security controls for small and medium organizations · reference checklist
Source: The Hacker News · https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html
Article prepared by RISS Canada’s monitoring team from the public sources cited above, with the assistance of artificial intelligence tools, then reviewed according to our editorial charter.
