Read the docs
TI-2026-73868 Aliases CVE-2026-110447GHSA-f97p-r72q-64h2

Collabora Online Built-in CODE Server allows remote code execution

Priority CRITICAL 99Exploited in the wildCWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution through an OS command injection in proxy.php (CWE-78). The flaw occurs when the CODE server is not running, for example after a recent restart, and a remote attacker can exploit it. It is exploited in the wild in September and October 2026, and CISA added it to the KEV catalog on 2026-10-23. Standalone Collabora Online servers are not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.

Why it matters now

Exploitation Active In CISA KEV since 2026-10-23CISA due date 2026-10-26
EPSS 0.73307 99th percentileScored 2026-11-07
Fix Fixed Collabora Online - Built-in CODE Server (Collabora): 26.4.303

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CollaboraCollabora Online - Built-in CODE Serverbefore 26.4.30326.4.303Patch availableCNA
  • Collabora Online - Built-in CODE Server VendorCollabora Affected before 26.4.303 Fixed in 26.4.303 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:collabora:collabora_online_-_built-in_code_server:*:*:*:*:*:nextcloud:*:*before 26.4.303VulnerableCollabora
  • cpe:2.3:a:collabora:collabora_online_-_built-in_code_server:*:*:*:*:*:nextcloud:*:* Versions before 26.4.303 Vulnerable ·Collabora

Remediation

Update Collabora Online Built-in CODE Server to 26.4.303. CISA requires U.S. federal agencies to fix it by 2026-10-26.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA Collabora Online - Built-in CODE Server (Collabora) Fixed in 26.4.303

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-110447
  2. 2026-10-14 Alias added: GHSA-f97p-r72q-64h2
  3. 2026-10-15 CISA SSVC decision points changed
  4. 2026-10-23 Added to CISA KEV
  5. 2026-10-23 CISA SSVC decision points changed
  6. 2026-10-23 Priority changed: MEDIUM → CRITICAL
  7. 2026-10-24 CISA SSVC decision points changed
  8. 2026-10-25 EPSS moved to the 95th–99th percentile
  9. 2026-10-26 CVSS score added · NVD
  10. 2026-10-29 EPSS moved to the 99th percentile and above

References

Advisory 1

Other 1

  • TI-2025-40711 Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy CVSS 4.0HIGH 7.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences