ZeroDayAlert

CVE-2026-110447: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.

Collabora Collabora Online – Built-in CODE Server Added to KEV 2026-10-23 Federal due 2026-10-26 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

Collabora Online with its built-in CODE Server when deployed within NextCloud is vulnerable to OS command injection leading to remote code execution. The vulnerability is triggered when the CODE server is not running. The record does not specify which versions of Collabora Online or NextCloud are affected, nor does it detail whether this applies to cloud-hosted or self-hosted deployments exclusively.

How to check whether this touches you

  • Inventory: Search your environment for NextCloud instances and confirm whether Collabora Online is installed and enabled as a document-editing integration.
  • Service state: Verify the operational status of the CODE server component within each Collabora Online installation; note instances where it is stopped, disabled, or unreachable.
  • Version fingerprinting: Query the Collabora Online and NextCloud version numbers through the administrative interface or API; treat version alone as an indicator, not confirmation of vulnerability status, since vendor patches may be backported.
  • Network reachability: Confirm whether the NextCloud instance and its Collabora integration are accessible from the internet or from untrusted network segments.

What to do

  1. Immediate containment: If the CODE server is stopped or non-functional on any NextCloud instance, restrict network access to that instance until you have patched or applied vendor mitigations. Do not rely on the stopped state as permanent protection.
  2. Check vendor guidance: Consult Collabora's published security advisories and NextCloud's security bulletins for the specific patch version, mitigation steps, or configuration changes required for your deployed versions.
  3. Prioritise by exposure: Apply remediation first to internet-facing or externally reachable NextCloud instances, in line with CISA BOD 26-04 guidance for federal systems and equivalent risk-based prioritisation for non-federal organisations.
  4. Logging and alerting: Enable detailed logging on the CODE server and NextCloud application layer; alert on any command injection patterns (shell metacharacters, backticks, $(...) syntax) appearing in requests to document-handling endpoints.
  5. Escalate if patch unavailable: If Collabora or NextCloud have not released a patch for your version, and you cannot implement network isolation, escalate to your change control and security teams to evaluate discontinuation or replacement of the product.

If you find you were exposed

Exploitation of OS command injection vulnerabilities typically occurs before public disclosure; review access logs and command execution logs dating back at least 90 days before the CVE publication date of 23 October 2026, focusing on CODE server requests and any unexpected process spawning from the NextCloud application user. Log retention constraints will likely be your primary limitation; extract and preserve logs covering that window as soon as possible. Look for evidence of reconnaissance, credential harvesting, or persistence mechanisms installed during the window when the CODE server was non-operational.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-110447 is being exploited. It cannot tell you whether Collabora Online – Built-in CODE Server is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →