CVE-2026-110447Collabora Collabora Online - Built-in CODE Server OS Command Injection

NVD

Vulnerability Summary

Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.

Severity Level

CRITICAL(9.2)

Published Date

Oct 14, 2026

Last Modified

Oct 24, 2026

PoC

Available(Nuclei)

Exploitation Status

ACTIVE

EPSS Score (30-Day)

73.31%Probability

Root Weakness (CWE)

CWE-78: OS Command Injection ↗

The software constructs all or part of an OS command using externally-influenced input, but does not properly neutralize special elements.

CVSS v4.0 Base Metrics — Score 9.2 (CRITICAL)

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack VectorNetwork

Attack ComplexityLow

Attack RequirementsPresent

Privileges RequiredNone

User InteractionNone

Confidentiality (Vulnerable System)High

Integrity (Vulnerable System)High

Availability (Vulnerable System)High

Confidentiality (Subsequent System)None

Integrity (Subsequent System)None

Availability (Subsequent System)None

Affected & Patched Versions

Affected Versions

Collabora Collabora Online - Built-in CODE Server < 26.4.303

Patched Versions

Collabora Collabora Online - Built-in CODE Server 26.4.303

What to do

Patch now. CISA lists this flaw as exploited in the wild and set a federal remediation deadline of Oct 26, 2026.

Check whether you run Collabora Collabora Online - Built-in CODE Server and which version.
Update to a patched version listed above, then confirm the new version.
Review logs and exposed services for signs of earlier compromise.

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CISA KEV Status

Listed in Known Exploited Vulnerabilities

Added: Oct 23, 2026
Remediation due: Oct 26, 2026 (deadline passed)

Timeline

Oct 14, 2026Published
Oct 23, 2026Added to CISA KEV catalog
Oct 24, 2026Record last modified
Oct 26, 2026KEV remediation due date

Score, severity and exploitation changes are tracked from the day Watchtower started logging them.

Get notified about new Collabora Collabora Online - Built-in CODE Server CVEsYou are reading CVE-2026-110447. Get an email when KEV listings, exploits or new CVEs match your stack.

Set up CVE alerts

Related Coverage

External References

Data last checked: Nov 14, 2026 07:11 UTC