Skip to content
NewA calmer, faster ZeroHour
Exploit / PoChighExploited in the wild

CISA lists exploited Collabora Online command injection in KEV

Original title: CISA Adds One Known Exploited Vulnerability to Catalog

CISA Advisoriesby CISA ()1 min read1 · 1 read
Read at cisa.gov
AI summary · x-ai/grok-4.7Summaries by Vani AI

CVE-2026-110447 in Collabora Online's built-in CODE Server is actively exploited; FCEB agencies must prioritize fixes.

CISA added CVE-2026-110447, an OS command injection vulnerability in Collabora Online's built-in CODE Server, to the Known Exploited Vulnerabilities Catalog because of evidence of active exploitation. Under BOD 26-04, Federal Civilian Executive Branch agencies must prioritize remediation of such KEV vulnerabilities on publicly exposed assets that grant total control after exploitation and check for compromise before patching. Other organizations are encouraged to do the same. The alert does not name a fixed version.

Key facts
  • The vulnerability is OS command injection in Collabora Online's built-in CODE Server.
  • BOD 26-04 covers FCEB agencies and publicly exposed high-risk assets.
  • KEV nominations require a CVE ID, exploitation evidence, and mitigation guidance.
Security assessment · AI, from the articleExploited in the wild

Impact: OS command injection on Collabora Online CODE Server

ProductAffected
Collabora Online built-in CODE Server—
What to do
  1. 1.Prioritize remediation of CVE-2026-110447 on exposed Collabora Online CODE Server systems.
  2. 2.Check whether threat actors compromised the system before the patch was applied.
Analyze CVE-2026-110447 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-110447
ATT&CK
T1190 Exploit Public-Facing Application
Tags
kevcollaboracollabora-onlinecommand-injectioncisa
Vendors
Collabora
Products
Collabora OnlineCODE Server
Organizations
CISA

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-110447
Unauthenticated OS command injection in Nextcloud CODE Server
9.212%KEVPoC
KEV

From the original article

1 min read at cisa.gov

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command Injection Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

CISA Advisories

By CISA · cisa.gov

Read the full article at CISA Advisories

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.