{"id":"CVE-2026-110447","title":"Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208","summary":"Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an O…","severity":"critical","cwe":["CWE-78"],"published":"2026-10-14","updated":"2026-10-14","sourceUpdated":"2026-10-14T19:17:10.487","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110447","references":[{"url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354","label":"cve@mitre.org"},{"url":"https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516","label":"cve@mitre.org"}],"tags":["nvd","in-the-wild","cve.org","exploit-available","kev"],"epss":0.11634,"epssPercentile":0.96027,"exploited":true,"ingestedAt":"2026-10-14T04:12:54.303Z","vendor":"Collabora","product":"richdocumentscode","affected":["richdocumentscode < 26.4.303"],"cvss":9.2,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-23T20:04:16.288937Z"},"cvssSource":"cna","exploits":{"github":1,"githubRepos":["https://github.com/adriyansyah-mf/cve-2026-110447"],"checkedAt":"2026-10-27T16:56:36.435Z"},"exploitAvailable":true,"kev":true,"kevDateAdded":"2026-10-23","kevDueDate":"2026-10-26","kevRansomware":false,"slug":"CVE-2026-110447","body":"## Overview\n\nCollabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"hadal","depthScore":78,"depthScoreParts":{"impact":50.6,"likelihood":2.3,"exploitation":25,"ransomware":0},"changes":[{"seq":229821,"id":"CVE-2026-110447","ts":1793104899137,"field":"epss","old":"0.02285","new":"0.12328"},{"seq":229090,"id":"CVE-2026-110447","ts":1792903529176,"field":"kev","old":"false","new":"true"},{"seq":223896,"id":"CVE-2026-110447","ts":1792268519403,"field":"exploit_available","old":"false","new":"true"},{"seq":221860,"id":"CVE-2026-110447","ts":1792035869931,"field":"cvss","old":null,"new":"9.2"},{"seq":221859,"id":"CVE-2026-110447","ts":1792035869931,"field":"severity","old":"none","new":"critical"}]}