{"cve":{"cve_id":"CVE-2026-110447","is_kev":true,"kev_date_added":"2026-10-23","kev_vendor_project":"Collabora","kev_product":"Collabora Online – Built-in CODE Server","kev_vulnerability_name":"Collabora Online – Built-in CODE Server OS Command Injection Vulnerability","kev_short_description":"Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.","kev_required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","kev_due_date":"2026-10-26","kev_known_ransomware":false,"kev_notes":"https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516 ; https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-110447","kev_cwes":["CWE-78"],"epss_score":0.01225,"epss_percentile":0.68286,"epss_as_of":"2026-10-15","description":"Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.","published_at":"2026-10-14T02:27:42.315000Z","last_modified_at":"2026-10-24T04:18:17.157000Z","cvss_v3_score":null,"cvss_v3_vector":null,"cvss_v3_severity":null,"cvss_v4_score":9.2,"cvss_v4_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cvss_v4_severity":"CRITICAL","ssvc_decision":null,"ssvc_exploitation":null,"ssvc_automatable":null,"ssvc_technical_impact":null,"cwes":["CWE-78"],"nvd_references":["https://github.com/CollaboraOnline/richdocumentscode/issues/354","https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516"],"vuln_status":"Deferred","trending_score":null,"is_trending":false,"has_trended":false,"trended_number_one":false,"trending_peak_score":null,"trending_peak_rank":null,"started_trending_at":null,"trended_number_one_at":null,"summary_generated":null,"summary_generated_at":null,"summary_model":null,"created_at":"2026-10-14T03:59:39.166600Z","updated_at":"2026-10-25T14:36:27.259323Z"},"effective_severity":"CRITICAL","badges":["kev","news"],"impact_analysis":[],"cvss_v3_decoded":{"version":null,"metrics":[]},"cvss_v4_decoded":{"version":"4.0","metrics":[{"metric":"AV","name":"Attack Vector","value":"N","value_label":"Network"},{"metric":"AC","name":"Attack Complexity","value":"L","value_label":"Low"},{"metric":"AT","name":"Attack Requirements","value":"P","value_label":"Present"},{"metric":"PR","name":"Privileges Required","value":"N","value_label":"None"},{"metric":"UI","name":"User Interaction","value":"N","value_label":"None"},{"metric":"VC","name":"Confidentiality (Vulnerable System)","value":"H","value_label":"High"},{"metric":"VI","name":"Integrity (Vulnerable System)","value":"H","value_label":"High"},{"metric":"VA","name":"Availability (Vulnerable System)","value":"H","value_label":"High"},{"metric":"SC","name":"Confidentiality (Subsequent System)","value":"N","value_label":"None"},{"metric":"SI","name":"Integrity (Subsequent System)","value":"N","value_label":"None"},{"metric":"SA","name":"Availability (Subsequent System)","value":"N","value_label":"None"}]},"affected":[{"vendor_slug":"collabora","vendor_name":"Collabora","product_slug":"collabora-online-built-in-code-server","product_name":"Collabora Online - Built-in CODE Server","version_start":"0","version_start_inclusive":true,"version_end":"26.4.303","version_end_inclusive":false,"cpe23_uri":"cve5:collabora:collabora-online-built-in-code-server:0:26.4.303"}],"exploit_refs":[],"news":[{"id":2849,"source":"The Hacker News","url":"https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html","title":"CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud","summary":"The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the wild.\n\nThe critical-severity vulnerabilities are listed below -\n\n\n  CVE-2026-110447 (CVSS score: 9.2) - An operating","thumbnail_url":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmm0pKX3kbfMC2GKemUiMT8PH1uDJIHn4AcmoiQ5nUK4TWZl0Ni_-k6kjpAFUrFzEWSSq_G307YJXTXmn9FZ7q6oOr5OEMASP9mrXOXrk9lSOGzqPCAbkQqpHsMxFe1q5CnyDZnqeDq_FiiC7jEzp0ie1r_nnQOSKcbPcKBdoXI-ycAjCZA9AuxemUhE5k/s1600/arista-cisa.jpg","author":"info@thehackernews.com (The Hacker News)","published_at":"2026-10-24T06:25:57Z","fetched_at":"2026-10-24T07:41:54.069320Z","trending_score":0.5432875948375059,"cve_ids":["CVE-2026-110447"]},{"id":2603,"source":"BleepingComputer","url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/","title":"Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers","summary":"Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. [...]","thumbnail_url":null,"author":"Bill Toulas","published_at":"2026-10-15T20:25:04Z","fetched_at":"2026-10-15T20:45:21.387613Z","trending_score":0.03183207871348847,"cve_ids":["CVE-2026-110447"]}],"references":[{"url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","source_type":"MISC","tags":[]},{"url":"https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516","source_type":"MISC","tags":[]}],"timeline":[{"type":"published","at":"2026-10-14T02:27:42.315000Z","label":"CVE published","source":null},{"type":"first_article","at":"2026-10-15T20:25:04Z","label":"First news coverage","source":"BleepingComputer"},{"type":"cisa_reported","at":"2026-10-23T00:00:00Z","label":"Added to CISA KEV catalog","source":"kev"}]}