# CVE-2026-110447: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

- Exploited (CISA KEV): yes, added 2026-10-23
- Published: 2026-10-14
- CVSS: 9.2 CRITICAL (v4.0)
- EPSS: 73.3% (99th percentile)
- CWE: CWE-78

Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | No public claim | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

## Our test (measured)

- OWASP Core Rule Set 4.25.0, paranoia level 1, anomaly threshold 5, default CRS settings: partial (2 of 4 requests blocked), template CVE-2026-110447, 2026-11-02
- OWASP Core Rule Set 4.25.0, paranoia level 2, anomaly threshold 5, default CRS settings: partial (2 of 4 requests blocked), template CVE-2026-110447, 2026-11-02

## Social

2 posts seen since 2026-11-02.

- Exploit repository (unvetted): https://github.com/maxprog-svg/CVE-2026-110447
- x 2026-11-02: #WeAreCyberHunters 🌐 🌍 ¿Nextcloud con «Built-in CODE Server»? Actualiza a 26.4.303 o elimínalo: CVE-2026-110447 (RCE sin auth) explotado. Busca webshells shx*.php https://t.co/sa9VLsNsfe #Ciberseguridad @Astaroth_WH @CyberHuntersOp @mstrbotnet @YourAnonShadows @YourAnonHunters (https://x.com/White_Hunters/status/2117387057311936742)

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-110447 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-110447