CVE-2026-110447
CRITICAL CISA KEV
ACT NOW
Priority: 1.07
BB Relevance:
81/100
Published: 2026-10-14
Modified: 2026-10-26
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
X
AT:
Present
VC:
High
VI:
High
VA:
High
Description
Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.
CISA Known Exploited Vulnerability
Vendor / Product
Collabora — Collabora Online – Built-in CODE Server
Date Added
2026-10-23
Remediation Due
2026-10-26
https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516 ; https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-110447
Weakness Classification (1)
References & Advisories (3)
Vendor Advisory
US Government Resource
Issue Tracking