Collabora Online – Built-in CODE Server: known exploitation and an inventory check (CVE-2026-110447)
Collabora Online – Built-in CODE Server. A CISA Known Exploited Vulnerabilities entry is a reason to check relevant assets and follow the vendor’s remediation guidance.
THE SOURCE RECORD / cisa
Read the official source ↗- Added to CISA KEV
- 23 Oct 2026 00:00 UTC
- Source updated
- Not stated by source
- Source checked
- 23 Oct 2026 22:15 UTC
- Source record status
- Active
- Vendor
- Collabora
- Product
- Collabora Online – Built-in CODE Server
- Source severity
- Not stated by source
- CVE identifiers
-
- CVE-2026-110447
- Affected products / versions
- Not stated by source
- Vendor-stated fixes
- Not stated by source
- Source-recommended action
-
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known exploitation
- Yes, reported by source
Fix details follow this vendor's disclosure. Distribution packages may use different revisions for backported fixes.
What this update means
CISA’s Known Exploited Vulnerabilities catalog identifies weaknesses for which CISA has evidence of exploitation. Catalog inclusion raises the priority of checking relevant software, but it does not prove that your organization has been attacked. The date shown as added to CISA KEV is the catalog inclusion date, not necessarily the date the weakness was discovered or first disclosed.
What the source confirms
The CISA KEV record describes the issue (brief excerpt):
Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that…
- Reference: CVE-2026-110447.
- Product: Collabora Online – Built-in CODE Server.
- Publisher or vendor: Collabora.
- Reported severity: not supplied in this record.
- CVE identifiers: CVE-2026-110447.
- Added to CISA KEV: 23 October 2026.
- Exploitation: the source reports exploitation in the wild; this does not establish compromise of your systems.
Affected products or versions
The supplied record does not specify affected versions. Use the official product list to check applicability.
Fixed versions or packages
CISA does not supply a fixed version in this record. Follow the vendor guidance linked from the official catalog entry.
What to do next
Locate the named product in your asset inventory and identify its owner, installed version and exposure. Follow the vendor remediation guidance referenced by CISA, checking prerequisites and any investigation advice. CISA deadlines belong to the directive and organizations to which they apply; establish an appropriate response for your environment. Do not assume a catalog entry provides a universal fixed version.
A small, read-only check
Use a fictional inventory entry to understand the check:
{"asset": "example-server", "product": "example-product", "version": "check locally", "owner": "IT team"}
Replace these labels in your own inventory. This illustrates record keeping; it is not an exploit, scanner or finding about a real system.
Prevention and recovery
Keep an inventory of software and its owner, retain tested backups, and review update notifications. After an approved update, check the running service and normal application behaviour. If you find signs of unauthorized access, preserve logs and involve your incident-response contact; installing a patch alone does not remove an existing intrusion.
Official source
Read the official advisory. Check it for later corrections, complete product lists and deployment instructions. This briefing explains the supplied evidence; it does not diagnose the security of any particular device.