CISA adds Collabora Online CODE Server flaw to KEV after reported exploitation
The agency cited reports of active exploitation in the wild for the critical OS command injection bug in the Nextcloud app, which allows remote code execution.
CISA added a critical vulnerability in Collabora Online Built-in CODE Server to its Known Exploited Vulnerabilities catalog, citing reports of active exploitation in the wild, The Hacker News reported on Oct. 24, 2026.
The flaw, tracked as CVE-2026-110447, carries a CVSS score of 9.2. It is an OS command injection issue in the richdocumentscode app used within Nextcloud, and it allows remote code execution when the CODE server isn't running, for example shortly after a restart. Standalone Collabora Online servers aren't affected, according to the advisory description.
CISA's catalog entry says the bug affects versions before 26.4.303. The agency's required action is to apply mitigations per vendor instructions, in line with its risk-based patching directive, and to follow its guidance for cloud services or discontinue use of the product where mitigations aren't available. The catalog lists a remediation due date of Oct. 26, 2026.
The same KEV update covered a second flaw in Arista VeloCloud Orchestrator, which the source also described as critical and actively exploited.
What defenders should do
- Check whether your Nextcloud deployment runs the built-in CODE Server app, and confirm its version against the vendor's advisory.
- Treat internet-facing instances as exposed until you've verified their state.
- Watch for signs of command execution around restarts, when the CODE server may be down.
The source didn't say who is exploiting the flaw or what the attacks target.
CVE references
Sources
- CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloudPrimarythehackernews.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning