Intelligence online17 sources monitored12 actively exploited 7d30 published 24hChecked recently
Vendor

Collabora

1 known exploited

Collabora news

CriticalAct nowExploitedCISA KEV

Collabora Online – Built-in CODE Server OS Command Injection Vulnerability (CVE-2026-110447) is being actively exploited, CISA warns

CISA added CVE-2026-110447 (Collabora Collabora Online – Built-in CODE Server) to its Known Exploited Vulnerabilities catalog on October 23, 2026, which means there is reliable evidence of exploitation in the wild. Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't…

Why it matters

CISA lists this as exploited in the wild. Unpatched affected systems are exposed to active attacks now.

Act now

Treat this as an emergency.

CISA Known Exploited VulnerabilitiesSecurity pros
CriticalAct nowExploitedCISA KEV

CISA Adds Six Known Exploited Vulnerabilities to Catalog

CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF)…

Why it matters

CISA lists this as exploited in the wild. Unpatched Media Server and SiteGuard Server Edition systems are exposed to active attacks now.

Act now

Treat this as an emergency.

CISA Cybersecurity Advisories · 2 sources
EnterpriseSecurity prosCritical infra
CriticalAct nowExploitedCISA KEV

Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers

Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud.

Why it matters

Source reporting says attackers are already exploiting this, so exposed affected systems are at immediate risk.

Act now

Treat this as an emergency.

BleepingComputerSecurity pros

Recent intelligence

The latest developments from the last 30 days, newest first.

  1. AdvisoryKEV

    Collabora Online – Built-in CODE Server OS Command Injection Vulnerability (CVE-2026-110447) is being actively exploited, CISA warns

    Basis: CISA Known Exploited Vulnerabilities (government advisory)

  2. Added to CISA KEVUpdateCVE-2026-110447

    CVE-2026-110447 added to CISA KEV: Collabora Collabora Online – Built-in CODE Server, Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

    Basis: CISA Known Exploited Vulnerabilities catalog

Actively exploited

All 1 →
CVE-2026-110447CVSS 9.2

Collabora Collabora Online – Built-in CODE Server

Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

Added Oct 23, 2026Fed. due Oct 26, 2026Coverage →

Products

Collabora Online – Built-in CODE Server · 1 KEV