What is the CVE-2026-110447 vulnerability in Collabora Online?
A critical security alert registered under the identifier CVE-2026-110447 has been issued, directly affecting the Collabora Online – Built-in CODE Server component when utilized inside the Nextcloud platform. The vulnerability consists of an operating system command injection that triggers specifically when the CODE server is not running.
This critical severity flaw features a CVSS score of 9.8, allowing external attackers to achieve remote code execution without requiring prior authentication on affected systems github.com. Due to the high risk it represents for user infrastructure, the Cybersecurity and Infrastructure Security Agency (CISA) has added the incident to its catalog of actively exploited threats cisa.gov.
Who is affected by this security breach in Nextcloud?
The vulnerability directly affects system administrators and organizations deploying Collabora Online in versions prior to 26.4.303 integrated within Nextcloud environments. By allowing command execution without requiring access credentials, any attacker with connectivity to the vulnerable service can compromise the server.
The exploitation of this attack vector endangers the confidentiality, integrity, and availability of the entire document collaboration platform. For this reason, CISA guidelines require affected entities to evaluate their exposure on the internet and apply the corresponding patches within established deadlines.
How do I protect myself against this vulnerability?
To protect production environments against this command injection and prevent security incidents, it is essential to follow the update recommendations provided by developers and guidelines from official channels help.nextcloud.com.
The recommended steps to mitigate the risk in affected platforms are detailed below:
- Verify the current version of Collabora Online and the integrated CODE server in your Nextcloud platform.
- Consult the manufacturer's official advisory to obtain details on available security updates.
- Update the affected software to a version greater than or equal to 26.4.303 following the manufacturer's instructions.
- Check the status of the CODE server and ensure compliance with security update prioritization guides.