Remote Code Execution Risk in Collabora Online Built-in CODE Server by Collabora
CVE-2026-110447

9.2CRITICAL

Key Information:

Vendor

Collabora

Status
Collabora Online - Built-in Code Server
Vendor
CVE Published:
14 October 2026

Badges

📈 Trended📈 Score: 5,240👾 Exploit Exists🟡 Public PoC🟣 EPSS 73%🦅 CISA Reported📰 News Worthy

What is CVE-2026-110447?

CVE-2026-110447 is a serious vulnerability affecting the Collabora Online Built-in CODE Server, which is incorporated within the Nextcloud application framework. This server is designed to facilitate collaborative document editing and can be integrated into various online platforms, enhancing productivity through real-time teamwork. The vulnerability resides in the way the CODE Server handles OS command injection through the proxy.php script, particularly when the CODE server is not actively running due to a recent restart. This flaw allows attackers to execute arbitrary commands on the server, potentially compromising the integrity and confidentiality of sensitive data stored within the Nextcloud platform. The risk is heightened for organizations that rely on this integration for document management, as a successful exploit could lead to severe operational disruptions, data exfiltration, or unauthorized access.

Potential impact of CVE-2026-110447

  1. Remote Code Execution: The primary impact of CVE-2026-110447 is the ability for an attacker to execute arbitrary code on affected servers. This could lead to unauthorized access and control over sensitive data, jeopardizing organizational security.

  2. Data Breach Risk: Exploiting this vulnerability could allow attackers to access confidential information stored within documents managed by Nextcloud, resulting in a data breach. Such incidents can lead to regulatory fines and reputational damage.

  3. Operational Disruption: The exploitation of this vulnerability could disrupt business operations, especially for organizations heavily reliant on real-time document collaboration. A successful attack could result in downtime or loss of access to critical resources, negatively affecting productivity and service delivery.

CISA has reported CVE-2026-110447

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-110447 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected Version(s)

Collabora Online - Built-in CODE Server 0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-110447
Created by maxprog-svg

News Articles

favicon imageEsecurity Planet

Critical Collabora Flaw Compromises Nextcloud Servers

Hackers are exploiting CVE-2026-110447 to compromise Nextcloud servers with web shells. See affected systems, warning signs, and mitigation steps.

2 weeks ago

favicon imageBleepingComputer

Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers

Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud.

3 weeks ago

References

https://github.com/CollaboraOnline/richdocumentscode/issu...
issue-tracking
https://help.nextcloud.com/t/to-collabora-built-in-user-u...
vendor-advisory

EPSS Score

73% chance of being exploited in the next 30 days.

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 🦅

    CISA Reported

  • 📈

    Vulnerability started trending

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by BleepingComputer

  • Vulnerability published

  • Vulnerability Reserved

.