TL;DR: CVE-2026-110447 is a known-exploited vulnerability in Collabora Collabora Online – Built-in CODE Server. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Then confirm no exposed, unpatched instance remains on your perimeter.
What CVE-2026-110447 is
According to the public vulnerability record, Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.
CISA summarises it as: Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.
Affected product & severity
CVE-2026-110447 affects Collabora Collabora Online – Built-in CODE Server. Confirm exact affected and fixed versions against the vendor's advisory.
| Property | Detail |
|---|---|
| CVE | CVE-2026-110447 |
| Vendor | Collabora |
| Product | Collabora Online – Built-in CODE Server |
| CVSS | 9.8 (CRITICAL) |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Weakness | CWE-78 |
| Added to CISA KEV | 2026-10-23 |
Why it is urgent
This CVE is in the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2026-10-23) — a list of flaws with confirmed exploitation in the wild. US federal agencies are required to remediate KEV entries on a deadline; for everyone else it is a strong signal to prioritise this now rather than wait. There is no proof-of-concept or exploit detail in this advisory by design.
What to do now
- Follow CISA's required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Apply the vendor's patch or mitigation for Collabora Collabora Online – Built-in CODE Server on every affected instance, per the official advisory linked below.
- Inventory every instance — production, staging, legacy and third-party appliances that bundle it. You cannot patch what you have forgotten you run.
- Verify the version actually deployed, not the one you think you run; the risk is the build actually serving traffic.
- Check for internet exposure. A known-exploited flaw on a reachable instance is an active risk — confirm none is exposed that should not be.
How to confirm your exposure
The hard part of a known-exploited CVE is rarely the patch — it is knowing where a reachable, unpatched instance still exists: a forgotten host, a staging box that drifted public, a third-party appliance. AssurePort's network and host penetration testing discovers exposed services, fingerprints their versions, and correlates them against known-exploited vulnerabilities — so a newly-weaponised CVE is checked against your real external footprint, including the hosts you don't have on a list. That is the window continuous testing is built to close.
Sources & further reading: NVD CVE-2026-110447 and the CISA KEV catalog are the authority on affected and fixed versions. Vendor/independent analysis: github.com, help.nextcloud.com, cisa.gov. This advisory contains no exploit code.
Frequently asked questions
What is CVE-2026-110447?
CVE-2026-110447 is a vulnerability in Collabora Collabora Online – Built-in CODE Server, rated CRITICAL (CVSS 9.8), listed in the CISA Known Exploited Vulnerabilities catalog. Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208.
Is CVE-2026-110447 being exploited?
Yes — it is in the CISA KEV catalog (added 2026-10-23), which lists vulnerabilities with confirmed in-the-wild exploitation. Treat it as an active, prioritise-now risk.
Which products are affected?
Collabora Collabora Online – Built-in CODE Server. Confirm the exact affected and fixed versions against the vendor's official security advisory before acting.
What should I do right now?
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Then inventory every instance, verify the version actually deployed, and confirm none is exposed and unpatched on your perimeter.