Skip to content
NewA calmer, faster ZeroHour
Exploit / PoChighExploited in the wild

CISA lists exploited Collabora CODE Server command injection

Original title: CISA KEV: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability — Collabora Collabora Online – Built-in CODE Server (CVE-2026-110447)

CISA Known Exploited Vulnerabilities ()1 min read1
Read at cisa.gov
Part of a story covered by 3 sourcesCISA lists exploited Collabora CODE Server command injectionMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Versions before 26.4.303 allow remote code execution when the built-in CODE server is not running.

CISA added CVE-2026-110447, in Collabora Online’s built-in CODE Server, to the Known Exploited Vulnerabilities catalog. The Nextcloud richdocumentscode app before 26.4.303 has an OS command injection in proxy.php that allows remote code execution when the CODE server is not running, such as after a restart. CISA says it was exploited in September and October 2026 and is distinct from CVE-2025-66208. Standalone Collabora Online servers are not affected.

Unconfirmed: Known ransomware campaign use is listed as unknown.

Key facts
  • The fixed version named is 26.4.303.
  • Exploitation occurred in September and October 2026.
  • Only the built-in CODE Server deployment is affected.
  • The required KEV action date is October 26, 2026.
  • Known ransomware campaign use is unknown.
Security assessment · AI, from the articleExploited in the wild

Impact: Remote code execution through OS command injection

ProductAffectedFixed in
Collabora Online Built-in CODE Serverbefore 26.4.30326.4.303
What to do
  1. 1.Update richdocumentscode to 26.4.303 or later.
  2. 2.Apply vendor mitigations and follow BOD 26-04.
  3. 3.Discontinue use if mitigations are unavailable.
Analyze CVE-2026-110447 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-110447
ATT&CK
T1190 Exploit Public-Facing ApplicationT1059 Command and Scripting Interpreter
Tags
cisa-kevcollaboranextcloudcommand-injectionremote-code-execution
Vendors
Collabora
Products
Collabora Online Built-in CODE Serverrichdocumentscode
Organizations
CISANextcloud

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-110447
Unauthenticated OS command injection in Nextcloud CODE Server
9.212%KEVPoC
KEV

From the original article

1 min read at cisa.gov

Collabora Online Built-in CODE Server before 26. 4. 303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208.

CISA Known Exploited Vulnerabilities

cisa.gov

Read the full article at CISA Known Exploited Vulnerabilities

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.