This letter studies physical-layer security in a cognitive radio (CR) network, where a primary user (PU) is eavesdropped by multiple collusive eavesdroppers. Under the PU secrecy outage constraint to protect the PU, the secondary users (SUs) are assumed to be allowed to transmit. The problem of joint SU scheduling and power control to maximize the SU ergodic transmission rate is investigated for both the scenarios of perfect and imperfect channel state information (CSI). It is shown that, although collusive eavesdroppers degrade the PU performance compared to non-collusive eavesdroppers, the SU performance is actually improved when the number of eavesdroppers is large. It is also shown that our proposed scheme with imperfect CSI can guarantee that the PU performance is unaffected by imperfect CSI.