What happened
A critical vulnerability has been identified in the built-in CODE Server component within Collabora Online when used in conjunction with the NextCloud platform. This flaw, designated as CVE-2026-110447, permits remote code execution through an OS command injection attack. Exploitation of this vulnerability has been confirmed to be active in the wild, indicating that malicious actors are actively leveraging this weakness to compromise affected systems. The vulnerability is associated with CWE-78, which involves improper sanitisation of user-supplied input, enabling arbitrary command execution on the server. Security researchers have reported that exploitation is possible even when the CODE server is not actively running, significantly increasing the risk for impacted deployments.
Who is affected
Organisations running Collabora Collabora Online with the built-in CODE Server integrated within their NextCloud environments are affected by this vulnerability. The impacted deployments are at risk of remote code execution if exposed to untrusted network access. The severity of the issue underscores the importance of assessing internet exposure and implementing appropriate mitigations. Stakeholders are responsible for determining their specific configurations and exposure levels, in accordance with established security guidance and policies.
Recommended actions
- Affected organisations should apply mitigations in accordance with vendor instructions, ensuring compliance with relevant federal guidance, including CISA’s BOD 26-04. This guidance emphasises prioritising security updates based on risk and recommends discontinuing use of the product if mitigations cannot be promptly implemented. It is essential to evaluate each asset's exposure to the internet to prevent unauthorised access that could facilitate exploitation. Monitoring for indicators of compromise associated with this vulnerability may help detect ongoing malicious activity.
