Plain-English Summary
CVE-2026-110447 is a confirmed actively exploited vulnerability affecting Collabora Collabora Online – Built-in CODE Server. Tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog as Collabora Online – Built-in CODE Server OS Command Injection Vulnerability, this flaw carries a CVSS base score of 8.8 (HIGH) and an EPSS exploitation probability of 73.31%. Because real-world threat actors are actively abusing this weakness in production environments, defenders and system administrators must treat patching or network-level isolation as an immediate priority rather than waiting for routine maintenance cycles.
According to defensive advisory data, Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running. Organizations running exposed or unpatched instances of Collabora Collabora Online – Built-in CODE Server face heightened operational risk, including unauthorized access, service disruption, or lateral movement depending on deployment architecture. Ransomware campaign association is currently recorded as 'Unknown'. If your environment exposes Collabora Online – Built-in CODE Server to untrusted networks, remote users, or partner integrations, prioritize verification of your current software build today.
Affected Products & Versions
| Vendor | Product | Weakness | Status |
|---|---|---|---|
| Collabora | Collabora Online – Built-in CODE Server | CWE-78 | Affected (Verify Build) |
How to Fix & Patch
Workarounds & Temporary Mitigations
If an immediate maintenance window is unavailable for Collabora Collabora Online – Built-in CODE Server, reduce exposure by restricting administrative interfaces behind VPN or zero-trust access proxies, enforcing strict egress firewall rules, and enabling multi-factor authentication on all management endpoints. Review vendor release notes for temporary configuration flags or disabled-by-default mitigations.
Detection & Log Indicators
Defenders should audit perimeter firewall logs, authentication telemetry, and endpoint EDR alerts around Collabora Online – Built-in CODE Server processes. Look for unexpected child process execution, anomalous outbound connections, or sudden configuration changes. Search community Sigma detection repositories for CVE-2026-110447 or CWE-78 behavioral rules and correlate events against CISA's 2026-10-23 advisory timeline.
- Search SigmaHQ Rules for Collabora / Collabora Online – Built-in CODE Server detections.
- Review CISA KEV Catalog due date: 2026-10-26.
Frequently Asked Questions
Is CVE-2026-110447 actively exploited in the wild?
Yes. CISA added CVE-2026-110447 (Collabora Collabora Online – Built-in CODE Server) to the Known Exploited Vulnerabilities catalog on 2026-10-23, confirming active real-world exploitation.
How do I fix CVE-2026-110447 on Collabora Collabora Online – Built-in CODE Server?
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Check the official vendor advisory linked in the references section for exact version numbers.
What is the CVSS and EPSS score for CVE-2026-110447?
CVE-2026-110447 holds a HIGH rating (CVSS 8.8) and a FIRST EPSS exploitation probability of 73.31%.
What if I cannot patch Collabora Online – Built-in CODE Server immediately?
Isolate management interfaces from public internet access, enforce strict network segmentation, and monitor Collabora Online – Built-in CODE Server logs for anomalous activity until patched.
Official References
Last updated: 2026-11-13 · Defensive guidance only (no exploit code).