[KEV] Collabora Online built-in CODE Server OS command injection → RCE when CODE server isn't running (CVE-2026-110447)

CISA added CVE-2026-110447 to the Known Exploited Vulnerabilities catalog on 2026-10-23 with confirmed in-the-wild exploitation. It is an OS command injection in the Collabora Online built-in CODE Server that permits RCE when the CODE server isn't running.

KEV = confirmed exploitation. This is in an enterprise collaboration component that may front sensitive documents and is frequently deployed on the same hosts as AI workloads; in the current AI-accelerated exploit cycle, KEV additions are the highest-priority patching signal even where the product is not itself AI.

OS command injection (CWE-78) in the built-in Collabora Online CODE Server when the CODE server isn't running, allowing remote code execution. Exploitation is confirmed in the wild per CISA.

Collabora Online built-in CODE Server (when used within the NextCloud platform)

Apply vendor mitigations per the Collabora/OwnCloud advisory and NextCloud guidance; prioritize per CISA BOD 26-04. See nextcloud help page and GHSA-g3vx-3m76-fghh.