THE U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical flaw in Collabora Online’s Built-in CODE Server to its Known Exploited Vulnerabilities (KEV) catalogue.
The vulnerability, tracked as CVE-2026-110447, is an OS command injection in Nextcloud’s proxy.php that affects Collabora Online – Built-in CODE Server prior to version 26.4.303. unauthenticated attackers can execute commands as the web server user when the local CODE server is stopped (for example during a restart, upgrade or crash). Standalone Collabora servers are not affected; users must update immediately to mitigate the risk.
Exploitation of CVE-2026-110447 has been reported since September 2026. According to the report, attackers have deployed PHP web shells and accessed configuration files containing credentials and application secrets on affected systems. The first attacks were documented by Nextcloud administrators on 10–11 September 2026, with malicious requests targeting proxy.php on version 26.4.302 from a single IP, followed by credential and cryptocurrency-wallet searches.
Three administrators disclosed issues on GitHub; while root access was not widely observed, several servers appeared compromised. After updating to 26.4.303, another intrusion attempt occurred on 14 September, but without a new shell. The CVE record confirms exploitation in Sept–Oct 2026, but the total number of compromised servers remains unknown.
The vulnerability affects only the Development Edition’s Built-in CODE Server deployment, and agencies and organisations are urged to apply the update and review their logs for evidence of similar activity. CISA also requires federal agencies to remediate by 26 October 2026 under relevant directives.