Warning Against Vulnerabilities Exploited in Actual Attacks (Collabora Online – Built-in CODE Server)

Overview

The US Cybersecurity and Infrastructure Security Agency (CISA) has released a list of vulnerabilities currently being exploited in attacks.

Affected Users

• Collabora Online – Built-in CODE Server users.

Vulnerability Information

• CVE-2026-110447.
• Classified as an OS command injection vulnerability.
• The announcement states that this vulnerability is currently being exploited in the wild.

Recommendations

• Apply mitigation measures in accordance with the vendor’s instructions.
• Comply with CISA BOD 26-04 (Risk-Based Security Update Prioritization Guidance) and forensic classification requirements.
• Apply the BOD 26-04 guidelines to cloud services.
• Discontinue use of the product if no mitigations are available.
• Users of the affected product should update to the latest version.

Note

CISA has published this vulnerability in its known exploited vulnerabilities catalog.