CVE-2026-110447: Collabora Online Built-in CODE Server RCE (KEV)

CVE-2026-110447 is an OS command injection in proxy.php of Collabora Online's built-in CODE Server, a Nextcloud app, that lets a remote unauthenticated attacker execute arbitrary code when the CODE server process isn't running (such as just after a restart); it has been exploited in the wild since September 2026 and CISA added it to KEV the day after publication.

CVE-2026-110447 is an OS command injection (CWE-78) in proxy.php of the built-in CODE Server shipped with the richdocumentscode Nextcloud app from Collabora Online. NVD's description states the flaw "allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208," and clarifies it only triggers "when the CODE server isn't running (e.g., the product was recently restarted)" — standalone Collabora Online servers that don't bundle this CODE Server are not affected (NVD).

NVD lists the CVE as "Analyzed" and records an NVD-assigned CVSS v3.1 base score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required (NVD).

The issue was first raised in a public GitHub issue against the richdocumentscode repository and then confirmed by Nextcloud in its own community help forum, which urged built-in CODE Server users to update as soon as possible (Nextcloud community advisory, GitHub issue).

CISA added CVE-2026-110447 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-23, the day after publication, with a required-action due date of 2026-10-26, and recorded exploitation as active per its SSVC assessment (CISA KEV).

As of 2026-10-26, FIRST scores the probability of exploitation at 0.1233 (96.165th percentile) (FIRST EPSS).

Because this is a confirmed, actively exploited unauthenticated RCE, any Nextcloud deployment using the built-in Collabora Online CODE Server on a version before 26.4.303 should upgrade immediately, with particular attention to the window right after a service restart when the flaw is reachable.

• OS command injection in proxy.php of the built-in CODE Server (richdocumentscode Nextcloud app) allows remote code execution when the CODE server process isn't running; exploited in the wild in September and October 2026. — NVD
• CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, NVD status Analyzed. — NVD
• Affected: built-in CODE Server (richdocumentscode) before 26.4.303, fixed in 26.4.303; issue first reported publicly and confirmed by Nextcloud, which urged affected users to update. — Nextcloud community advisory
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-23, due date 2026-10-26, exploitation recorded as active. — CISA KEV
• EPSS score is 0.1233 (96.165th percentile) as of 2026-10-26. — FIRST EPSS