CISA ADDS ACTIVELY EXPLOITED COLLABORA ONLINE CODE SERVER COMMAND INJECTION VULNERABILITY TO KEV CATALOG

THREAT SUMMARY

Category: Actively Exploited OS Command Injection Vulnerability
Affected Product(s): Collabora Online – Built-in CODE Server (richdocumentscode Nextcloud app)
CVE: CVE-2026-110447
CVSS: 9.2 Critical (v4.0)
Weakness: CWE-78 — Improper Neutralization of Special Elements Used in an OS Command
Primary Risks: Unauthenticated remote command execution, execution of commands with web server user privileges, potential installation of malicious files, and compromise of affected application environments
Threat Status: Active exploitation confirmed by CISA
Affected Environment(s): Vulnerable Nextcloud deployments with the built-in CODE Server app installed
Attack Vector: Unauthenticated requests to the vulnerable proxy.php component when the built-in CODE server is not running
CISA Action: Added CVE-2026-110447 to the KEV Catalog on October 23, 2026
Required Response: Upgrade richdocumentscode to version 26.4.303 or later in the applicable supported release line, or remove the affected app. Disabling the app alone is insufficient. Federal agencies must follow applicable BOD 26-04 requirements.

---

CISA has added CVE-2026-110447, an OS command injection vulnerability affecting the built-in CODE Server used by Collabora Online, to its Known Exploited Vulnerabilities Catalog after determining that the flaw is being actively exploited.

The October 23 addition moves CVE-2026-110447 beyond theoretical risk and into confirmed real-world exploitation. CISA identifies the vulnerability as an operating-system command injection weakness, a class of vulnerability that can become particularly serious when attacker-controlled input reaches operating-system command-processing functions.

CISA’s October 23 alert confirms active exploitation but provides limited technical information. Collabora’s security advisory identifies the affected component, vulnerable software versions, exploitation conditions, severity rating, and the privileges available following successful exploitation. The identity of the threat actors and the full extent of any resulting compromises remain unconfirmed in the available official technical guidance.

What CISA has confirmed is sufficient to elevate the issue into immediate vulnerability-management priority: CVE-2026-110447 is under active exploitation.

---

Vulnerability Details

CVE-2026-110447 — Collabora Online Built-in CODE Server OS Command Injection Vulnerability

CVE-2026-110447 is a critical operating-system command injection vulnerability affecting the built-in Collabora Online CODE Server distributed through the Nextcloud richdocumentscode application. The vulnerability is classified as CWE-78 and carries a CVSS v4.0 score of 9.2, placing it in the Critical severity category.

According to Collabora’s October 14, 2026, security advisory, the vulnerability exists in the application’s proxy.php component. When the built-in CODE server is not running, an unauthenticated remote attacker can exploit the flaw to execute operating-system commands with the privileges of the web server user.

The confirmed attack mechanism creates a risk of unauthorized command execution within the affected server environment. The extent of any subsequent compromise depends on the web server account’s permissions, available security controls, and whether an attacker establishes additional access.

CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog on October 23, 2026, following evidence of active exploitation.

---

Affected Product and Environments

Collabora identifies the affected software as the built-in CODE Server Nextcloud application, distributed under the package name richdocumentscode.

Affected versions: Releases before 26.4.303.

Fixed version: 26.4.303.

Standalone Collabora Online servers are not affected by this specific vulnerability.

The vendor states that administrators must upgrade the affected application to a corrected release or remove the application entirely. Simply disabling the vulnerable app does not eliminate the exposure.

Organizations should identify affected Nextcloud installations across production, development, testing, standby, and disaster-recovery environments. Particular attention should be given to instances that are externally accessible or fall outside centralized patch-management processes.

Administrators should verify the installed richdocumentscode version and confirm that the vulnerable component has been updated or removed. Successful remediation should be established through direct inspection rather than assumptions based on maintenance records.

---

Operational Impact

The operational risk associated with CVE-2026-110447 extends beyond ordinary application malfunction. Collabora confirms that successful exploitation can permit unauthenticated remote command execution with the privileges of the web server user, giving an attacker the ability to execute commands within the affected server environment.

The exploitation condition is particularly important. The vulnerable proxy.php component can be exploited when the built-in CODE server is not running, including during certain service restarts, upgrades, or crashes. A deployment may therefore become exposed during transitional operating conditions even when the CODE service normally runs.

The potential consequences include unauthorized access to application files, modification of data accessible to the web server account, and installation of malicious components where filesystem permissions allow. Broader compromise depends on the host configuration, available privileges, network connectivity, and additional security weaknesses.

Because exploitation has been confirmed, affected organizations should evaluate whether unauthorized activity occurred before remediation. Applying the corrected version addresses the vulnerability but does not establish whether attackers previously executed commands or modified the server.

---

Why KEV Status Matters

CISA’s Known Exploited Vulnerabilities Catalog is designed to help organizations prioritize vulnerabilities that have demonstrated real-world exploitation.

For a vulnerability to qualify for potential inclusion in the KEV Catalog, CISA states that it must have:

• A CVE identifier.
• Evidence of exploitation.
• Clear mitigation guidance.

CVE-2026-110447 has crossed that threshold.

The vulnerability should therefore not be treated as a routine future patching item. CISA has determined that exploitation evidence already exists, which means organizations running potentially affected systems should move identification and remediation ahead of lower-risk vulnerabilities that do not carry the same confirmed exploitation status.

KEV inclusion is especially important for organizations managing large vulnerability backlogs because it provides a practical method for separating demonstrated threats from flaws that have not yet been observed in active attacks.

---

Federal Response

The October 23 addition falls under Binding Operational Directive 26-04: Prioritizing Security Updates Based on Risk.

BOD 26-04 establishes vulnerability-management requirements for Federal Civilian Executive Branch agencies and reinforces the importance of the KEV Catalog in federal vulnerability prioritization.

Under the directive, federal agencies must prioritize rapid remediation of high-risk KEV vulnerabilities, specifically those affecting publicly exposed assets where successful exploitation can grant total control of the affected asset. Lower-risk vulnerabilities may receive deferred action when they do not meet the same risk threshold.

BOD 26-04 also establishes basic expectations for determining when agencies must assess whether threat actors compromised a system before remediation was applied.

That requirement is critical for actively exploited vulnerabilities. Installing a patch or applying a mitigation can close the vulnerable condition going forward, but remediation alone cannot establish whether an attacker accessed the system while it remained exposed.

CISA encourages organizations outside the federal government to adopt the same risk-based vulnerability-management approach and prioritize KEV-listed vulnerabilities.

CISA’s KEV entry for CVE-2026-110447 records an October 26, 2026, remediation due date and directs federal agencies to follow applicable BOD 26-04 requirements, including forensic-triage guidance. The recorded date must be interpreted within the directive’s risk-based scope and should not be presented as a universal deadline for private-sector organizations.

---

Defensive Guidance

Organizations operating the affected Nextcloud richdocumentscode application should upgrade to version 26.4.303 or later, or remove the application if upgrading is not possible.

Collabora confirms that disabling the application alone is insufficient to prevent exploitation.

Priority defensive actions should include:

• Identify all Nextcloud installations containing the richdocumentscode application.
• Verify the installed version and determine whether it precedes 26.4.303.
• Upgrade affected installations to the corrected release or remove the app.
• Confirm that the update or removal has been completed successfully.
• Examine deployments where the CODE server was stopped, restarting, or otherwise unavailable.
• Review web server activity associated with the affected proxy.php component.
• Investigate unexpected commands or processes initiated under the web server account.
• Examine application directories for unauthorized files, including possible PHP webshells.
• Preserve relevant logs and forensic evidence where compromise is suspected.
• Assess legacy Nextcloud deployments that may no longer receive security updates.

Organizations using end-of-life Nextcloud releases, particularly version 29 and earlier, should upgrade to a supported release or remove the affected application, consistent with Collabora’s advisory.

---

Compromise Assessment

Active exploitation of CVE-2026-110447 has been documented, making compromise assessment an important part of the response for organizations that operated vulnerable versions of the built-in CODE Server.

The vulnerability permits remote command execution through proxy.php when the CODE server is not running. Investigators should therefore examine web server logs, application activity, and operating-system events associated with periods when the affected service was unavailable.

The Nextcloud community has reported instances of suspicious PHP files and possible webshell activity involving affected installations. Such reports warrant investigation, although they do not establish that every vulnerable server was compromised.

Priority investigative areas include:

• Requests to the affected proxy.php component.
• Unexpected operating-system commands executed by the web server account.
• Unusual child processes originating from web server services.
• Newly created or modified PHP files in application directories.
• Unauthorized webshells or executable scripts.
• Changes to application configuration or server permissions.
• Unexpected outbound network connections.
• New user accounts or unexplained privilege changes.
• Suspicious scheduled tasks or background services.
• Missing, altered, or unexpectedly cleared security logs.

These checks represent investigative priorities rather than a complete set of confirmed indicators unique to CVE-2026-110447.

If unauthorized activity is identified, incident response should extend beyond installing the corrected release. Investigators may need to preserve forensic evidence, identify executed commands, examine modified files, rotate exposed credentials, and determine whether the attacker gained persistence or accessed connected systems.

---

OS Command Injection Risk

OS command injection vulnerabilities deserve elevated attention because they can cross the boundary between an application and the operating system beneath it.

Applications routinely interact with operating-system functions to process files, execute utilities, manage services, communicate with other components, and perform administrative tasks. When attacker-controlled input reaches those functions without adequate restriction, the vulnerable application may be manipulated into performing actions its developers did not intend.

The impact can vary substantially depending on the execution context. A vulnerable process operating with limited privileges may expose a narrower attack surface than one operating with extensive system permissions. Network position, surrounding access controls, containerization, service isolation, and account privileges can also affect the final outcome.

CISA’s alert does not provide enough technical detail to characterize those conditions for CVE-2026-110447. Defenders should therefore avoid assigning specific post-exploitation capabilities that have not been established.

The active-exploitation finding already provides sufficient reason for organizations to act.

---

Publicly Exposed Systems Require Priority Attention

BOD 26-04 places particular emphasis on high-risk KEV vulnerabilities affecting publicly exposed federal assets when successful exploitation can provide total control of the asset.

That emphasis reflects a broader cybersecurity principle that applies outside the federal government as well. Internet-facing systems can be discovered, scanned, and targeted remotely, giving malicious actors a wider opportunity to identify vulnerable deployments.

Organizations running Collabora Online should therefore determine whether affected CODE Server environments are reachable from the public internet or other untrusted networks and prioritize those systems accordingly.

External exposure should also be reviewed after remediation. Services that do not require public accessibility should not remain unnecessarily reachable, and administrative functions should be restricted wherever practical.

Reducing exposure does not replace patching, but it can reduce the number of paths available to an attacker.

---

30-Day Outlook

The next 30 days will be important for organizations operating the affected Collabora Online built-in CODE Server application, particularly those that have not yet verified whether vulnerable versions remain installed across their Nextcloud environments.

Security teams should continue prioritizing the following areas:

• Completion of upgrades to richdocumentscode version 26.4.303 or later.
• Removal of vulnerable applications where supported upgrades cannot be completed.
• Identification of installations that were disabled but not removed.
• Review of service outages, restarts, and upgrades that may have created exploitable conditions.
• Investigation of suspicious activity involving proxy.php and the web server account.
• Examination of application directories for unauthorized files or possible webshells.
• Verification that legacy, standby, and test environments have also been remediated.
• Monitoring for additional vendor findings and newly documented exploitation activity.

Organizations should also review systems that were vulnerable before the October 23 KEV addition. Collabora’s CVE record identifies exploitation during September and October 2026, meaning the relevant investigative period extends beyond CISA’s catalog announcement.

The principal remaining concern is that systems may appear secure following an application update while unauthorized files, compromised credentials, or other modifications introduced before remediation remain undetected.

---

TRJ Verdict

CISA’s October 23 addition of CVE-2026-110447 confirms active exploitation of a critical operating-system command injection vulnerability affecting the Collabora Online built-in CODE Server application used with Nextcloud.

Collabora’s advisory establishes that an unauthenticated remote attacker can exploit the vulnerable proxy.php component when the built-in CODE server is not running, allowing commands to execute with the privileges of the web server user. The vulnerability carries a CVSS v4.0 score of 9.2 and is corrected in richdocumentscode version 26.4.303.

The exploitation condition creates an important operational concern because restarting, upgrading, or losing the CODE service can expose the vulnerable path. Simply disabling the affected application does not provide sufficient protection. Organizations must upgrade to the corrected release or remove the application.

CISA’s confirmation of active exploitation also makes retrospective security assessment necessary where evidence indicates possible compromise. Installing the fix does not automatically remove malicious files, revoke exposed credentials, or reverse unauthorized changes made before remediation.

Federal Civilian Executive Branch agencies must follow applicable BOD 26-04 remediation and forensic-triage requirements. Organizations outside the federal government should apply the same practical priorities according to their exposure and operational risk.

The central lesson is that an application component does not need to be fully operational to present an attack surface. In this case, the absence of a running CODE server is itself part of the exploitation condition, making accurate asset identification, timely upgrades, application removal where necessary, and post-exploitation assessment essential to protecting affected Nextcloud environments.

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---