CVE Feed
— Unscored

Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

CVE-2026-110447 Exploited

Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.

Being exploited in the wild

Catalogued 23 October 2026 · US federal remediation deadline 26 October 2026

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for…

Exploit code is also public: Public PoC · Nuclei template

Assessment

CVSS
Not yet scored
Severity
Unscored
Known exploited
Yes — listed in the CISA KEV catalog
Exploit availability
CISA KEV, Public PoC, Nuclei template
Published
23 October 2026
Last updated
23 October 2026
Affected
Collabora · Collabora Online – Built-in CODE Server
Weakness
CWE-78

At the source

References

Community proofs of concept

No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.

Submit a proof of concept

Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.

Before you submit *

Query this programmatically

Agents can read this through the MCP endpoint, or over HTTP:

curl https://cve.zerocrew.in/api/cve/CVE-2026-110447