CVE-2026-110447: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
Summary
A critical OS command injection vulnerability, CVE-2026-110447, has been identified in Collabora Online's built-in CODE Server, particularly when integrated with NextCloud. This flaw enables remote code execution if the CODE server is not operational. Users are urged to apply vendor-provided mitigations promptly.
IFF Assessment
This vulnerability allows for remote code execution, posing a significant risk to systems and data.
Severity
The vulnerability allows for OS command injection, leading to remote code execution. This has a high attack vector (Network) and high impact on Confidentiality, Integrity, and Availability. The exploitability is also considered high as it can occur when the CODE server is not running.
CISA KEV: Listed as actively exploited. Federal patch due: October 26, 2026. Known ransomware use: Unknown.
Defender Context
This CVE highlights a critical vulnerability in a widely used collaboration tool that could be exploited for remote code execution. Defenders should prioritize applying vendor patches or mitigations immediately and assess their exposure to this vulnerability, especially in cloud environments. Tracking known ransomware usage related to this CVE is also important.