CVE-2026-110447Vulnerability
Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
Reported by 4 independent sources · first reported by The Hacker News · last reported
Last reported today
Fix due 26 Oct 2026
Used by ransomware: not knownCISA KEV catalogue
higher than 68% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
6 reports, newest first · the exact sentence from each-
U.S. CISA adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog“Cybersecurity and Infrastructure Security Agency (CISA) added a Collabora Collabora Online – Built-in CODE Server flaw, tracked as CVE-2026-110447 (CVSS score of 9.2), to its Known Exploited Vulnerabilities (KEV) catalog.”
-
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud“CVE-2026-110447 (CVSS score: 9.2) - An operating system command injection vulnerability in Collabora Online – Built-in CODE Server (aka richdocumentscode) when used within the NextCloud platform that could allow remote code execution via "proxy.php" when the CODE local document s…”
-
CISA Adds One Known Exploited Vulnerability to Catalog“CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command Injection Vulnerability”
-
⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More“…abora RCE Flaw Exploited to Backdoor Nextcloud Servers — Threat actors are exploiting a critical command execution flaw, tracked as CVE-2026-110447 (CVSS score: 9.2), in the Collabora Online - Built-in CODE Server app for Nextcloud to backdoor servers.”
-
Risky Bulletin: Russia arrests DataSuckers hacking group“[CVE-2026-110447 // Attack reports]”
-
Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App“Collabora fixed it in version 26.4.303 on September 11 and on October 14 published an advisory with the identifier CVE-2026-110447, warning that turning off the app does not help: it must be updated or removed.”
Indicators reported together
named in the same reports- kevincollier.bsky[.]socialin 1 report
Copy this indicator · defanged
Also named with it: CVE-2026-76519, CVE-2026-0322, CVE-2026-34073, CVE-2026-16812, CVE-2021-36260, CVE-2026-83498, CVE-2026-74580, CVE-2026-93952, CVE-2026-79724, CVE-2026-85025, CVE-2026-81204, CVE-2026-103947, CVE-2026-103946, CVE-2026-106126, CVE-2026-14814, CVE-2026-16301, CVE-2026-92883, CVE-2026-97229, CVE-2026-85947
Thanks — we review every report.