HIGHVulnerability
Verified
Global

CISA KEV: Collabora Collabora Online – Built-in CODE Server — Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

·Source: CISA KEV

Updated:

Executive Summary

Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.

Analysis

Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running. Added to CISA Known Exploited Vulnerabilities catalog on 2026-10-23. Remediation due: 2026-10-26.

Indicators of Compromise (1)

CVE (1)
CVE-2026-110447
NVDMITRE CVE
Source Attribution

Originally published by CISA KEV on Oct 23, 2026. Verified by: CISA.

Related Threats

CRITICALVulnerability

CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the wild. The critical-severity vulnerabilities are listed below - CVE-2026-110447 (CVSS score: 9.2) - An operating

CVE-2026-110447
The Hacker News
MEDIUMVulnerability

CVE-2026-110447 exploited to backdoor Nextcloud servers through Collabora CODE app

[object Object]

CVE-2026-110447
r/cybersecurity
CRITICALVulnerability

Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers

Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. [...]

CVE-2026-110447
BleepingComputer