Collabora Online built-in CODE server in NextCloud exploited for remote code execution
Original title：CISA KEV added CVE-2026-110447: Collabora Collabora Online – Built-in CODE Server – Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
What happened
CISA says an OS command injection flaw in Collabora Online's built-in CODE server, when used with NextCloud, is being exploited. It allows remote code execution when the CODE server isn't running, so servers could be taken over.
Who is affected
- Anyone running NextCloud with built-in Collabora CODE
- Organizations self-hosting NextCloud
What to do
Check the vendor advisory for the fixed version and update the built-in CODE server immediately. Until then, consider disabling it or restricting external access, and review logs for suspicious activity.
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| Collabora Online – Built-in CODE Server (NextCloud 連携時) | 要確認 | 要確認 |
Why this flag
CISA KEV に掲載（悪用確認済み）かつ重大な影響
Red flag: session stopped — Exploitation confirmed with major impact. Assigned only when listed in CISA KEV or confirmed by a primary source.
Sources
- Primary source：CISA Known Exploited Vulnerabilities ↗
- CVE：CVE-2026-110447 ↗