CVE-2026-110447 KEV
?
unscored · CVSS · EPSS 1.2% (pctl 69)
Patch first
On CISA KEV — known exploited in the wild, due 2026-10-26.
Description
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.
Scoring
| CVSS | unscored |
|---|---|
| EPSS | 1.23% — more likely to be exploited than 69% of all CVEs |
| Weakness | CWE-78 |
| On CISA KEV | yes — remediate by 2026-10-26 |
| Public exploit | none known |
| Published | 2026-10-14 |
| Last modified | 2026-10-24 |
CISA KEV
| Name | Collabora Online – Built-in CODE Server OS Command Injection Vulnerability |
|---|---|
| Added | 2026-10-23 |
| Due | 2026-10-26 |
| Vendor / product | Collabora / Collabora Online – Built-in CODE Server |
| Ransomware use | none reported |
References
→ the Explorer · watch your stack · NVD