Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
🚨SEVERITY: CRITICAL — CVSS 9.2Security Advisory
TL;DR 📌
- Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn’t running.
- Highest CVSS: 9.2 (Critical).
- Listed in CISA KEV (2026-10-23) — this is being exploited in the wild.
- Check the advisory for fixed releases — remediation detail is in the vendor link below.
- CVEs: CVE-2026-110447.
What it is
Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn’t running.
For leadership 🧭
Executive summary. Risk is Critical (CVSS 9.2) across any Collabora kit you run. Follow the remediation in the vendor advisory within Immediate — CISA KEV entries carry a federal remediation deadline.
Why it matters:
- Exposure depends on deployment topology and which access paths reach the affected component.
- Treat internet-facing and management-plane instances as higher risk than internal-only ones.
- Keep monitoring for abnormal authentication and configuration events until upgrades complete.
Now / Next / Later:
- Now: confirm whether you run the affected versions, and check exposure of any that are internet-facing.
- Next: apply the remediation the advisory specifies, through an approved change window.
- Later: add a control check so builds cannot drift back onto a vulnerable train.