Threat Pulse 62High
Collabora Online command injection added to CISA KEV; webshells seen
Severity 6PatchedconfirmedWeb servers and gatewaysCloud and SaaS

An OS command injection in the Collabora Online CODE server allows remote code execution and is being exploited to plant webshells on Nextcloud plus Collabora deployments. CISA set an Oct 26 deadline for federal agencies.

What to do: Upgrade richdocumentscode (built-in CODE server) to 26.4.303 or later, or remove the app; CISA deadline Oct 26

· 12 days ago · Nextcloud and Collabora Online deployments · nvd.nist.gov
Sourcesnvd.nist.govcisa.govcisa.govCISA Known Exploited VulnerabilitiesCISA Known Exploited VulnerabilitiesCISA Known Exploited VulnerabilitiesCISA Known Exploited VulnerabilitiesCISA Known Exploited Vulnerabilities
On X
@TheHackersNewsunverified
Open on X
@CISACyberverifiedOct 23, 19:56 UTC

🛡️ We added Collabora/Online Built-in CODE Server #RCE vulnerability CVE-2026-110447 to our Known Exploited Vulnerabilities Catalog. Visit https://t.co/myxOwap1Tf & apply mitigations to protect your org from cyberatt

Open on X
Why this score

Exploited, patch available, niche deployment

time of earliest verified post

Back to the board

Updated Nov 5, 01:45 UTC. Refreshes on its own.

Add a threat

Paste a link to an advisory, an article or an X post. A person reads every submission before it shows; nothing posts on its own.

Share

The picture people see when the link is posted
Post on XSave picture

This picture is what X, iMessage, Slack and Facebook show under the link. It is drawn fresh from the live board: the board and chart pictures update every 10 minutes, an event picture follows that event.