CISA lists exploited Collabora Online flaw CVE-2026-110447
Original title: U.S. CISA adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog
Unauthenticated attackers can run OS commands as the web server user when the built-in CODE server is stopped; fix is 26.4.303.
CISA added CVE-2026-110447, a critical OS command injection flaw rated CVSS 9.2 in Nextcloud’s proxy.php for Collabora Online Built-in CODE Server before 26.4.303, to the Known Exploited Vulnerabilities catalog. Standalone Collabora servers are not affected. In versions up to 26.4.302, unsanitized request data reached a Bash command, and exploitation is possible only when the local CODE server is stopped. Reported attacks since September 2026 deployed PHP web shells and sought credentials and secrets. Federal agencies must fix it by October 26, 2026.
Unconfirmed: The total number of compromised servers remains unknown.
- The first recorded attack was September 10, 2026, against version 26.4.302.
- Attackers deployed a PHP web shell and searched for credentials and cryptocurrency wallets.
- No reviewed logs showed file exfiltration or root access.
- Maintainer mmeeks urged updates and removal of leftover shx*.php files.
- Only the Development Edition’s Built-in CODE Server deployment is affected.
Impact: OS command execution as the web server user and possible secret exposure
| Product | Affected | Fixed in |
|---|---|---|
| Collabora Online Built-in CODE Server | before 26.4.303; versions up to 26.4.302 | 26.4.303 |
- 1.Update Collabora Online Built-in CODE Server to 26.4.303.
- 2.Remove leftover shx*.php web-shell files.
- 3.Treat data accessible to the web server account as potentially exposed.
- CVEs
- CVE-2026-110447
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1059 Command and Scripting InterpreterT1505.003 Web Shell
- Organizations
- CISA
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-110447 | Unauthenticated OS command injection in Nextcloud CODE Server | 9.2 | 12% | KEVPoC | KEV |
From the original article
2 min read at securityaffairs.com
U. S. Cybersecurity and Infrastructure Security Agency (CISA) adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.