- Technical severity
- CRITICAL (9.2)
- Exploitation
- confirmed-in-the-wild-by-authority
- Exposure
- company-applicability-unknown
- Response priority
- accelerated
- Analytical confidence
- high
Assessment
CVE-2026-110447 affects Collabora Collabora Online – Built-in CODE Server. CISA has confirmed inclusion in its known-exploited catalog. DualScope assigns accelerated response priority under the stated generic context; each company should recalculate that priority from actual inventory, exposure and compensating controls.
Evidence and claims
- confirmed: CISA lists CVE-2026-110447 in the Known Exploited Vulnerabilities catalog.
- attributed: NVD reports CVSS 9.2 (CRITICAL); this measures technical severity, not company-specific risk.
- attributed: Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.
- attributed: FIRST EPSS estimates a 12.3% probability of exploitation activity in the model window; this is a model estimate, not direct observation.
Company action plan
immediate · accelerated
Vulnerability management / asset owners
Applies when: The organization uses Collabora Collabora Online – Built-in CODE Server; prioritize internet-facing instances.
Action: Identify affected deployments and compare installed versions with the vendor advisory or supported fixed release. Where applicable to the organization, consult CISA KEV required actions and deadlines; federal directives do not automatically impose obligations on every reader.
Dependencies: Authoritative asset inventory, product ownership and vendor advisory access.
Verify: Export the matched inventory with version and exposure evidence; have the service owner confirm false positives.
Residual risk: Unknown or unmanaged assets may remain exposed.
near-term · accelerated
Platform operations / change management
Applies when: An affected version is confirmed.
Action: Apply the vendor-supported fix or documented mitigation through normal emergency change controls. Preserve rollback and configuration backups.
Dependencies: Vendor fix guidance, maintenance window and tested rollback.
Verify: Re-scan the deployed version and validate service health and security-control telemetry after the change.
Residual risk: Remediation does not establish that prior compromise did not occur.
investigation · urgent
Detection engineering / incident response
Applies when: The vulnerable service was reachable during the exposure window or suspicious activity exists.
Action: Review vendor-recommended indicators and relevant authentication, process, network and administrative logs. Escalate anomalies under the incident-response plan.
Dependencies: Retained logs and vendor-supported detection guidance. Do not treat generic IP blocklists as proof.
Verify: Document query scope, time range, data gaps and investigation outcome separately from patch status.
Residual risk: Absence of observed indicators is not proof of absence when telemetry is incomplete.
What remains uncertain
- Company deployment and internet exposure are unknown.
What would change this assessment
- A vendor advisory changes affected or fixed versions.
- An authoritative source changes the CVE status or exploitation assessment.
- New direct incident evidence changes the known attack prerequisites or impact.
Sources and methodology
- cisa-kev · retrieved October 27, 2026
- nvd-cve · retrieved October 27, 2026
- first-epss · retrieved October 27, 2026
DualScope uses deterministic automated analysis of public sources. It does not claim firsthand testing, private telemetry or interviews.