CISA Adds Collabora Online OS Command Injection (CVE-2026-110447) to KEV Catalog

What Happened

CISA has officially added CVE-2026-110447 to the Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability is an OS command injection flaw located in the built-in CODE Server component of Collabora Online. The inclusion in the KEV Catalog is based on confirmed evidence of active exploitation in the wild, indicating that threat actors are currently leveraging this weakness to gain unauthorized access to systems.

The addition of this CVE to the KEV list triggers specific compliance requirements for Federal Civilian Executive Branch (FCEB) agencies under Binding Operational Directive (BOD) 26-04. This directive mandates that agencies prioritize the remediation of vulnerabilities listed in the KEV Catalog, particularly those that grant total control of the asset post-exploitation. For non-federal organizations, while BOD 26-04 does not apply, CISA strongly encourages the adoption of similar risk-based vulnerability management practices to address high-severity, actively exploited flaws.

Who Is Affected

Organizations running Collabora Online with the built-in CODE Server enabled are directly affected by this vulnerability. Collabora Online is a web-based office suite that provides an alternative to Microsoft Office, often used in enterprise environments for document collaboration and editing. The specific attack vector involves the CODE Server component, which is a development environment integrated into the platform. If this component is exposed to the internet or accessible by untrusted users, it becomes a primary target for attackers.

Both federal agencies and private sector entities using Collabora Online should treat this as a critical incident. The vulnerability is not limited to a specific version but affects the functionality of the built-in CODE Server. Administrators must identify all instances of Collabora Online in their environment and verify whether the CODE Server feature is active. If the feature is not required for business operations, disabling it entirely is the most effective immediate mitigation strategy.

Impact

The impact of CVE-2026-110447 is severe, as OS command injection vulnerabilities typically allow attackers to execute arbitrary system commands with the privileges of the service account running the application. In the context of Collabora Online, this could lead to full compromise of the underlying host system. Attackers could install malware, create backdoors, exfiltrate sensitive data, or pivot to other internal systems. Given that Collabora Online often handles sensitive corporate documents, a compromise poses a significant risk to data confidentiality and integrity.

Because this vulnerability is actively exploited, the window for safe operation is extremely short. Any unpatched instance is considered compromised until proven otherwise. The potential for lateral movement and persistent access makes this a high-priority threat. Organizations should assume that if their Collabora Online instance was exposed to the internet without proper access controls, it may have already been targeted. Incident response teams should prepare to investigate potential breaches in parallel with remediation efforts.

Exposure

Exposure to CVE-2026-110447 is determined by the accessibility of the Collabora Online CODE Server. If the service is bound to a public IP address or accessible via a reverse proxy without strict authentication and network segmentation, the risk is critical. Even if the service is internal, if it is accessible from untrusted networks or if the authentication mechanisms are weak, the exposure remains high. Attackers often scan for known services and exploit vulnerabilities automatically, so any instance that is discoverable is at risk.

Defenders should conduct a thorough audit of their network to identify all Collabora Online instances. This includes checking for instances running in containerized environments, cloud services, or on-premises servers. Use network scanning tools to detect open ports associated with Collabora Online and verify the configuration of the CODE Server. Pay special attention to instances that are not behind a Web Application Firewall (WAF) or that lack multi-factor authentication (MFA) for administrative access. These configurations significantly increase the likelihood of successful exploitation.

What To Do

Immediate remediation actions are required to mitigate the risk of CVE-2026-110447. The following steps should be taken in order of priority:

• Apply the latest security patch for Collabora Online that addresses CVE-2026-110447. Verify the patch level on all instances to ensure the vulnerability is resolved.
• If patching is not immediately possible, disable the built-in CODE Server feature in the Collabora Online configuration. This removes the attack vector entirely.
• Restrict network access to the Collabora Online service using firewalls and access control lists (ACLs). Ensure that only trusted IP addresses can connect to the service.
• Enable multi-factor authentication (MFA) for all administrative accounts and user accounts with access to sensitive documents. This adds an additional layer of security against credential-based attacks.
• Review logs for signs of exploitation, such as unusual command executions, unexpected file creations, or unauthorized access attempts. Look for patterns that indicate command injection, such as shell commands in HTTP requests.
• Isolate any compromised systems from the network and initiate incident response procedures. Preserve forensic evidence for analysis.

What To Watch

After remediation, continuous monitoring is essential to detect any residual threats or new exploitation attempts. Monitor Collabora Online logs for any suspicious activity, particularly around the CODE Server component. Look for indicators of compromise (IoCs) such as unexpected outbound connections, unusual process spawns, or modifications to system files. Implement real-time alerting for any detected anomalies to enable rapid response.

Stay informed about updates from CISA and the Collabora Online vendor. CISA will continue to add vulnerabilities to the KEV Catalog that meet the specified criteria, so regular checks of the catalog are necessary. Additionally, monitor threat intelligence feeds for any new information regarding CVE-2026-110447, such as new exploit techniques or related vulnerabilities. Proactive monitoring and staying updated on the threat landscape are critical for maintaining a secure environment.