CISA Adds CVE-2026-110447 to KEV List Due to Active Exploitation

## Overview CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities (KEV) list on October 23, 2026. This vulnerability affects the Collabora Online – Built-in CODE Server used within the Nextcloud platform. It allows remote code execution through an OS command injection in the proxy.php file when the CODE server is not running. Evidence shows exploitation occurred in September and October 2026. ## Technical Details The vulnerability arises when the CODE server is restarted or not running, allowing attackers to inject commands via proxy.php. This issue is specific to the Collabora Online deployment with CODE Server and does not affect standalone instances of Collabora Online. The CVSS score for this vulnerability is 9.2, indicating a critical risk. ## Impact Successful exploitation of CVE-2026-110447 can lead to unauthorized remote code execution. Attackers can potentially gain control over the affected system, compromising sensitive data and services. Organizations using the vulnerable version should prioritize addressing this issue to prevent exploitation. ## Mitigation Defenders should update to Collabora Online – Built-in CODE Server version 26.4.303 or later immediately. Regularly monitor for updates and apply security patches as they become available. Additionally, consider implementing network segmentation and strict access controls to limit exposure to this vulnerability.