Collabora Online Built-in CODE Server OS Command Injection Added to CISA KEV
CISA KEV · 3 sources
What's on the official record
23 October — CVE-2026-110447, OS command injection in Collabora Online's built-in CODE server.
CISA added CVE-2026-110447 to the Known Exploited Vulnerabilities Catalog on 2026-10-23 (catalog version 2026.10.23). The vulnerability is an OS command injection (CWE-78) in Collabora Online's built-in CODE server when used within the NextCloud platform, allowing remote code execution when the CODE server is not running. Federal remediation due date: 2026-10-26. The CVE record names the fix as fixed in 26.4.303; earlier versions are affected. CISA's required action is to apply mitigations in accordance with vendor instructions, consistent with BOD 26-04.
The CISA ADP SSVC assessment records exploitation=active, automatable=yes, impact=total. FIRST's EPSS estimate is 0.023 (83rd percentile, 2026-10-24). Ransomware use is unknown.
Assessment
For a platform or AI-stack owner, the record lets you check whether any Collabora Online deployment runs the built-in CODE server inside NextCloud, and decide whether to patch to 26.4.303 or isolate the instance until the update is applied. The remote-code-execution condition — a CODE server that is not running — is a configuration state worth verifying directly rather than assuming.
For a cyber underwriter, the record lets you check policyholders' Collabora Online estates against version 26.4.303 and decide whether to require the patch as a control or price the exposure. The CISA ADP SSVC marks exploitation active and impact total, which is the signal to treat this as a live remediation item rather than a theoretical one.
What would change this call
A vendor advisory or CISA update naming additional affected versions would change the version check against 26.4.303. A change in CISA's exploitation status — currently active — would change how urgently the patch-or-isolate decision is treated.
What to check next
| Check | Why it matters |
|---|---|
| Confirm Collabora Online version against 26.4.303 | Earlier versions are affected; the fix is version-specific |
| Verify whether the built-in CODE server is deployed within NextCloud | The RCE condition is tied to that configuration |
| Watch for a vendor advisory update beyond the CVE record | The required action is mitigation per vendor instructions |
Confidence
The identifiers, dates, and fix version are taken directly from the CISA KEV entry and the CVE.org record, which agree on CVE-2026-110447, dateAdded 2026-10-23, dueDate 2026-10-26, and catalog version 2026.10.23. The exploitation and impact figures are the CISA ADP SSVC assessment and FIRST's EPSS estimate, not independently observed exploitation. Confidence in the record itself is high; confidence in real-world exploitation is not separately established beyond the CISA ADP field.
Sources
[1] Collabora Online Built-in CODE Server OS Command Injection Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-110447
[2] CVE record CVE-2026-110447 — https://www.cve.org/CVERecord?id=CVE-2026-110447
[3] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog