Skip to content
securitytabs

LiveUpdated

CISA says attackers are exploiting a critical flaw in Collabora Online's built-in server

A serious flaw in the document-editing server built into Collabora Online is being used in attacks, according to the US cyber agency CISA. Organizations that run this product, including through other platforms that bundle it, should check it now.

Written by the SecurityTabs AI newsroom from 3 outlets, every paragraph cited; vulnerability scores come from NVD, FIRST and CISA, not the AI.

Business Action

What this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Many small organizations use Collabora Online through a file-sharing or office platform that bundles it. CISA says the flaw is being exploited, and the coverage reviewed gives no fix details. [1][2]

What to do

  1. Ask your IT provider or hosting service whether your document platform uses Collabora Online's built-in CODE server. [1]
  2. If it does, ask the provider to confirm the product is on the vendor's latest release and watch the vendor's advisories. [1][2]

Mid-size company

A small IT or security team

What to know

CISA lists the flaw as exploited and set a federal deadline of October 26, 2026. No mitigation or indicators appear in the coverage reviewed. [1][2]

What to do

  1. Inventory systems running the Collabora Online Built-in CODE Server, including those bundled in other platforms. [1]
  2. Check the vendor's advisories for an update and apply it on an urgent patch window. [1][3]
  3. Review who can reach these servers from the internet. [1]

Large enterprise

A security operations team

What to know

The flaw is in CISA's KEV catalogue on evidence of active exploitation. The sources do not publish detection rules or indicators yet. [1][2]

What to do

  1. Identify all deployments of the Collabora Online Built-in CODE Server, including embedded instances in third-party platforms. [1]
  2. Track the vendor's advisories for patch guidance and apply it as federal KEV timelines suggest. [1][3]
  3. Review logs on exposed instances for unexpected commands or activity as part of incident response. [1]

Vulnerabilities

What happened

CISA added CVE-2026-110447, an operating system command injection flaw in the Collabora Online Built-in CODE Server, to its Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using. CISA said the listing is based on evidence of active exploitation. [1]

The Hacker News reports CISA added the flaw on Friday, together with an Arista VeloCloud Orchestrator flaw, and gives the Collabora flaw a CVSS score of 9.2. Command injection means an attacker can make the server run commands of their choosing. [2][3]

Exploitation and rating

CISA's catalogue entry lists the flaw as exploited. Its federal due date is October 26, 2026, and CISA has marked known ransomware use as unknown. The coverage reviewed does not say who is exploiting the flaw or how many systems are affected. [1][2]

CISA says this type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Federal civilian agencies must follow Binding Operational Directive 26-04 on prioritizing security updates. [1]

What is not yet known

The articles reviewed do not describe a fixed version, a workaround or indicators of compromise. Organizations should consult the vendor's advisories for patch details. [1][3]

Timeline

  1. Security Affairs reported the Collabora listing. [3]

  2. The Hacker News reported that CISA listed the Collabora flaw together with an Arista VeloCloud Orchestrator flaw. [2]

  3. CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalogue. [1]

Explained

The technology and terms in this story. Learn more

Why it was possible

The weaknesses behind this story's CVEs, from each CVE Record.

Sources

  1. [1]CISA Advisories · Oct 23, 12:00 UTC
    CISA Adds One Known Exploited Vulnerability to Catalogcontext
  2. [2]The Hacker News · Oct 24, 06:25 UTC
    CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloudcontext
  3. [3]Security Affairs · Oct 24, 16:53 UTC
    U.S. CISA adds Collabora Online flaw to its Known Exploited Vulnerabilities catalogcontext