CVE-2026-110447: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

Patch now

CRITICAL 9.2EXPLOITEDREMOTEMITIGATE

CVE-2026-110447 is a critical-severity flaw (CVSS 9.2) affecting Collabora Online – Built-in CODE Server, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CO

Why this priority

Critical severity
Exploited in the wild (CISA KEV)
CISA SSVC: automatable with total technical impact
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	9.2 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	1.2% (top 31%)
CISA exploited list	Yes, fix due 2026-10-26
Weakness	CWE-78
Published	2026-10-14
Last modified	2026-10-24

Publisher (CNA): MITRE · Vendor: Collabora

Timeline

2026-10-14 03:17 UTCPublished CVE record published
2026-10-23Exploited Added to the CISA Known Exploited Vulnerabilities list
2026-10-24 04:18 UTCUpdated Record last modified
2026-10-26Deadline CISA due date for US federal agencies to patch

Collabora Collabora Online – Built-in CODE Server MITIGATE

Affected: See advisory

Fixed in: no fixed release known

Safe to downgrade to: no unaffected older release

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Exact fixes by distribution

A distro patch exists: prefer upgrading over downgrading.

Fedora 46 · clementine · FIXED · 1.4.2-1.fc46 · FEDORA-2026-3e748ef4d3 · source

sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

GitHub PoC: adriyansyah-mf/cve-2026-110447 (0 stars)

Advisories and coverage

Official advisories

CISA Alerts and Advisories: CISA Adds One Known Exploited Vulnerability to Catalog 2026-10-23

Research and news

The Hacker News: CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud 2026-10-24

Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

References

← Back to latest CVEs