CVE-2026-110447: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

BleepingComputer reports that threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud.[2]eSecurity Planet reports that Collabora's security advisory said the flaw can let an unauthenticated attacker execute operating system commands with the privileges of the web server account when the local CODE server is offline.[1] According to IONIX, the flaw has a CVSS v4.0 base score 9.2 (Critical)[3].eSecurity Planet says the vendor fixed the issue in version 26.4.303 and warned that disabling the app is not sufficient. Administrators must update it or remove it. Standalone Collabora Online servers are not affected.[1]Aviatrix reports that Collabora patched the vulnerability in version 26.4.303 on September 11, but the security advisory wasn't published until October 14[4]. BleepingComputer says Collabora blamed the delay primarily to GitHub CVE-processing backlogs, which it said were under strain from increasing volumes of AI-driven security reports.[2]SecurityOnline reports that attackers searched for *.kdbx, wallet.dat, keystore.json, Bitwarden, 1Password, and Bitcoin, Monero, or Ethereum directories.[5] eSecurity Planet says the reports reviewed by the publication did not show the attackers gaining root access.[1]According to WindowsForum, CISA's alert is dated October 23, 2026[6], and CISA's KEV catalog lists a due date of October 26, 2026 for this entry.[6]ThreatWire reports that Collabora maintainers also advised removing unexpected PHP files under the app directory, including names matching shx*.php.[7]