CISA Adds CVE-2026-110447 to KEV List Amid Active Exploitation

## Overview CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities (KEV) list on October 23, 2026. This vulnerability affects the Collabora Online Built-in CODE Server when used with Nextcloud. It allows remote code execution via an OS command injection in proxy.php when the CODE server is not running. Evidence of exploitation in the wild has been reported in September and October 2026. ## Technical Details The vulnerability exists in versions of Collabora Online Built-in CODE Server prior to 26.4.303. It specifically arises when the CODE server is restarted, leaving the proxy.php file vulnerable to injection attacks. This issue does not affect standalone Collabora Online servers, making the deployment context critical for risk assessment. Attackers can exploit this vulnerability to execute arbitrary commands on the server. ## Impact The CVSS score for this vulnerability is 9.2, indicating a critical risk. Successful exploitation can lead to full remote code execution, compromising the integrity and confidentiality of the affected systems. Organizations using the vulnerable version of Collabora Online within Nextcloud should prioritize this issue due to its potential for severe impact. ## Mitigation Defenders should update to Collabora Online Built-in CODE Server version 26.4.303 or later immediately. Regularly monitor for updates from Collabora and review server configurations to ensure that the CODE server is running as expected. Implementing additional security measures, such as network segmentation and intrusion detection systems, can help mitigate the risk of exploitation.