Collabora Online Built-in CODE Server Flaw Exploited in Wild

Collabora Online’s Built-in CODE Server contains a critical vulnerability that enables remote code execution, according to the National Vulnerability Database. This flaw, identified as CVE-2026-110447, has been actively exploited in the wild during September and October 2026. The vulnerability allows attackers to execute arbitrary operating system commands on affected systems.

The National Vulnerability Database rates the severity of this issue at 9.2, classifying it as critical. The weakness is categorized under CWE-78, which denotes improper neutralization of special elements used in an OS command. This classification indicates that the software fails to properly sanitize input before passing it to the underlying operating system for execution.

Context and Background

The vulnerability exists specifically within the proxy.php component of the Collabora Online Built-in CODE Server. According to the NVD record, the exploit succeeds when the CODE server is not currently running, such as immediately after the product has been restarted. This specific state creates a window of opportunity for attackers to inject malicious commands.

This issue affects versions of the Collabora Online Built-in CODE Server prior to 26.4.303. The NVD explicitly states that this is a different vulnerability from CVE-2025-66208, which was previously reported. It is important to distinguish this specific code injection flaw from other historical vulnerabilities in the Collabora ecosystem to ensure accurate remediation efforts.

Unlike broader infrastructure flaws, this vulnerability is confined to specific deployment configurations. Standalone Collabora Online servers are not affected by CVE-2026-110447. Only deployments that utilize the integrated Built-in CODE Server, often associated with Nextcloud installations, face this specific risk. This distinction helps administrators narrow their scope when auditing their environments for exposure.

The active exploitation reported for September and October 2026 suggests that threat actors are targeting this specific configuration. The fact that the exploit works during server restarts indicates a persistent threat vector that could be triggered by routine maintenance or unexpected service interruptions. This behavior aligns with the high criticality rating assigned by security databases.

Who Is Affected

Organizations running Collabora Online with the Built-in CODE Server version 26.4.303 or earlier are directly at risk. The NVD record identifies "richdocumentscode" as the specific app component involved in this Nextcloud integration. Administrators managing these self-hosted or enterprise deployments must verify their current version numbers immediately.

The vulnerability does not impact users of standalone Collabora Online servers. If an organization has separated its CODE server deployment from the main application layer, this specific CVE-2026-110447 flaw is not present in their architecture. This architectural difference provides a built-in mitigation for those using the standalone approach.

The exposure is technical rather than user-facing in terms of authentication. The OS command injection occurs at the server processing level via proxy.php. This means that the flaw can be triggered without necessarily requiring valid user credentials, depending on the network exposure of the proxy component. The critical rating reflects this high potential for unauthorized access.

What should you do?

Security teams should immediately audit their Collabora Online deployments to determine if they are using the Built-in CODE Server. If the installed version is before 26.4.303, the system is vulnerable. Administrators should plan to upgrade to version 26.4.303 or later as soon as the vendor provides the update.

Monitor server logs for unusual activity, particularly around service restarts. Since the vulnerability is exploitable when the CODE server is not running, any unexpected command execution during maintenance windows could indicate an attempt to leverage CVE-2026-110447. Network segmentation can also reduce the attack surface for these services.