First published Oct 23, 2026, 7:52:15 PM UTC · Last updated Oct 23, 2026, 7:52:15 PM UTC

CVE-2026-110447: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

Reported by CISA Known Exploited Vulnerabilities

The source reports an OS command injection vulnerability in Collabora Online’s Built-in CODE Server when used within NextCloud, allowing remote code execution when the CODE server is not running. It directs stakeholders to apply vendor mitigations or discontinue use if mitigations are unavailable.

Share this event

Follow: Events in United States

Manage follows

Why it matters

The source calls for mitigation and risk-based security updates for affected product use.

Generated scores

Scores are based on the cited reporting and use a 1–10 scale. Read the methodology.

Confidence: 7/10How certain the assessment is based on the clarity and evidence in the cited reporting.
Geographic reach: 1/10How widely the event reaches, from a local area (1) to worldwide impact (10).
Global importance: 2/10The event's broader significance, from limited importance (1) to major global importance (10).
Impact magnitude: 3/10The scale or severity of the real-world impact, from minor (1) to extreme (10).
Urgency: 5/10How time-sensitive the event is, from low urgency (1) to immediate attention needed (10).

Primary official sources

CISA Known Exploited Vulnerabilities CVE-2026-110447: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

Report an issue

Read our editorial process and corrections policy.

Continue exploring

Related developments reported in the last 30 days. These are not necessarily ongoing incidents.

Same topic
Project Gigabit network build contract - North DorsetOct 23, 2026, 2:56 PM UTC
A Project Gigabit network-build contract was awarded to Wessex Internet for access to gigabit-capable broadband at more than 7,000 premises in North Dorset.
Same topic
Project Gigabit network build contract - CambridgeshireOct 23, 2026, 2:55 PM UTC
BDUK awarded CityFibre a Project Gigabit contract to provide up to 45,000 premises in Cambridgeshire with access to gigabit-capable broadband.
Same topic
Premises contracted and built, Project Gigabit contractsOct 23, 2026, 2:09 PM UTC
Building Digital UK reports on premises contracted and built under Project Gigabit contracts. The supplied text includes no counts or specific locations.
Same topic
KZN launches fibre pre-provisioning project in EmpangeniOct 23, 2026, 12:22 PM UTC
A fibre infrastructure pilot is being implemented at the Empangeni Phase 1A Housing Development, where 405 households are under construction. The project uses a “Pipe and Box” method to install infrastructure during construction and could serve as a model for similar developments across South Africa.
Same topic
Sanders and Democratic lawmakers ask Meta to explain alleged favouritism towards BolsonaroOct 23, 2026, 9:48 AM UTC
Bernie Sanders and 11 other Democratic lawmakers asked Meta chief executive Mark Zuckerberg to explain alleged unequal treatment of the campaigns of Luiz Inácio Lula da Silva and Flávio Bolsonaro on Instagram, Facebook and WhatsApp. The campaigns were facing each other in Brazil’s presidential runoff.
Same topic
CVE-2026-114625: Arista VeloCloud Orchestrator SQL Injection VulnerabilityOct 23, 2026, 12:00 AM UTC
The excerpt describes a SQL injection vulnerability in Arista VeloCloud Orchestrator on-prem that may enable remote access to privileged functionality and compromise the orchestrator or managed data. It calls for applying mitigations or discontinuing use if mitigations are unavailable.

Loading related developments…

Explore events in united states