What happened
CISA added CVE-2026-110447 to the Known Exploited Vulnerabilities catalog on 2026-10-23 with confirmed in-the-wild exploitation. It is an OS command injection in the Collabora Online built-in CODE Server that permits RCE when the CODE server isn't running.
Why it matters
KEV = confirmed exploitation. This is in an enterprise collaboration component that may front sensitive documents and is frequently deployed on the same hosts as AI workloads; in the current AI-accelerated exploit cycle, KEV additions are the highest-priority patching signal even where the product is not itself AI.
Attack vector
OS command injection (CWE-78) in the built-in Collabora Online CODE Server when the CODE server isn't running, allowing remote code execution. Exploitation is confirmed in the wild per CISA.
Affected systems
Collabora Online built-in CODE Server (when used within the NextCloud platform)
Mitigation
Apply vendor mitigations per the Collabora/OwnCloud advisory and NextCloud guidance; prioritize per CISA BOD 26-04. See nextcloud help page and GHSA-g3vx-3m76-fghh.