CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities (KEV) catalogue on 23 October 2026. The flaw affects Collabora Online – Built-in CODE Server when used within the Nextcloud platform and can allow remote code execution through OS command injection when the CODE server is not running.
The vulnerability is an OS command injection issue. An attacker can exploit it to execute code remotely in the stated configuration. The supplementary data assigns it a CVSS score of 9.2, rated Critical. A patch is available; organisations should consult the vendor’s advisory for patch and mitigation details.
KEV inclusion indicates that CISA has confirmed active exploitation. The available data does not establish whether attackers have used the flaw in ransomware campaigns. CISA set 26 October 2026 as the remediation deadline for affected federal civilian executive branch (FCEB) agencies.
CISA requires organisations to apply mitigations in accordance with vendor instructions and applicable BOD 26-04 guidance, including its Forensics Triage Requirements. For cloud services, agencies should follow applicable BOD 26-04 guidance; if mitigations are unavailable, they should discontinue use of the product. Stakeholders must assess each asset’s internet exposure and follow BOD 26-04 patching guidelines. FCEB agencies are directly subject to CISA’s remediation requirements, and all organisations should review their exposure and take appropriate action.
See the [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-110447) and [CISA KEV catalogue](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) for full details.