Government Advisory

CISA Flags Actively Exploited Flaw in Collabora Online's Built-in CODE Server

CISA · 23 Oct 2026

Key Takeaway If your business runs Collabora Online, check whether the built-in CODE Server is in use and exposed to the internet, apply the vendor's fix promptly, and review systems for signs of compromise.

The US Cybersecurity and Infrastructure Security Agency (CISA) has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation. The flaw is tracked as CVE-2026-110447 and is an OS command injection vulnerability in the built-in CODE Server of Collabora Online.

CISA notes that this type of vulnerability is a frequent attack vector for malicious cyber actors. Command injection issues can let an attacker run their own commands on an affected system. The advisory is aimed at US federal agencies, which must follow Binding Operational Directive 26-04. That directive requires them to prioritise rapid fixes for KEV-listed vulnerabilities on publicly exposed assets that give an attacker total control once exploited. It also sets expectations for checking whether a system was compromised before a patch was applied.

The directive applies only to federal agencies, but CISA encourages all organisations to adopt risk-based vulnerability management and to prioritise fixing KEV Catalog vulnerabilities. Businesses that use Collabora Online with the built-in CODE Server should check their deployment against the CVE record and vendor guidance.

CISA KEV Collabora Online Command Injection Vulnerability Management

Summarised by CISO AI from CISA, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.