Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

CISA lists exploited Collabora CODE Server command injection

3 sources · 3 articlesFirst reported Updated ()1 · 1 read
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

CISA added actively exploited CVE-2026-110447 in Collabora’s built-in CODE Server; federal agencies must patch by October 26.

CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog after attacks in September and October 2026. The OS command injection, rated CVSS 9.2, is in Nextcloud’s proxy.php for Collabora Online’s built-in CODE Server before 26.4.303 and allows remote code execution only when that local server is not running. Standalone Collabora Online servers are not affected. According to Security Affairs, the first recorded attack was September 10 against version 26.4.302; attackers deployed PHP web shells and searched for credentials and cryptocurrency wallets, and reviewed logs showed neither file exfiltration nor root access. Federal Civilian Executive Branch agencies must apply fixes by October 26, 2026, and maintainer mmeeks urged updates plus removal of leftover shx*.php files.

Key facts
  • Fixed in 26.4.303; versions through 26.4.302 are vulnerable.
  • Unsantized request data in proxy.php reached a Bash command.
  • Only the Development Edition built-in CODE Server is affected.
  • CISA says it is distinct from CVE-2025-66208; ransomware use is unknown.
  • Attackers used PHP web shells to seek credentials, secrets, and wallets.
  • FCEB agencies face a KEV remediation deadline of October 26, 2026.
Analyze CVE-2026-110447 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Sep 10, 2026First recorded attack hit version 26.4.302 · Security Affairs
  2. Oct 23, 2026CISA added CVE-2026-110447 to the KEV catalog · CISA
  3. Oct 26, 2026FCEB agencies must apply fixes · CISA

What each outlet adds

beyond the shared facts
  • CISASept–Oct exploitation, unknown ransomware use, distinct from CVE-2025-66208
  • The Hacker NewsCVSS 9.2; fixed in September 2026; web-shell backdoors on Nextcloud
  • Security AffairsSept. 10 first attack, wallet search, no exfil or root, mmeeks advice
CVEs
CVE-2026-110447CVE-2026-114625
Vendors
CollaboraNextcloudArista
Products
Collabora OnlineBuilt-in CODE ServerVeloCloud OrchestratorNextcloudCollabora Online Built-in CODE Serverrichdocumentscode
Organizations
CISANextcloud
Countries
United States

Coverage

oldest first · one row per article · UTC
  1. · 2d ago CISA Known Exploited VulnerabilitiesFirst report

    CISA lists exploited Collabora CODE Server command injection

    Versions before 26.4.303 allow remote code execution when the built-in CODE server is not running.

  2. · 1d ago The Hacker News

    CISA adds exploited Collabora Online and VeloCloud flaws to KEV

    FCEB agencies must patch command injection in Collabora CODE Server and SQL injection in on-prem VeloCloud Orchestrator by October 26.

  3. · 1d ago Security Affairs

    CISA lists exploited Collabora Online flaw CVE-2026-110447

    Unauthenticated attackers can run OS commands as the web server user when the built-in CODE server is stopped; fix is 26.4.303.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-110447
Unauthenticated OS command injection in Nextcloud CODE Server
9.212%KEVPoC
KEV
CVE-2026-114625
SQL injection in Arista VeloCloud Orchestrator grants superuser
9.41%KEV
KEV