Collabora Online - Built-in CODE Server

Reported Context (3)

and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), CISA Adds Two Actively Exploited Collabora Online and Arista VeloCloud Flaws to KEV
Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. Attackers Exploit Collabora Code-Execution Flaw in Nextcloud’s Built-In Server App
Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack Flaw in Nextcloud’s Built-in Collabora CODE App Exploited to Plant Web Shells

CVE (5)

People (3)

MITRE ATT&CK (6)

Vendors (3)

Products (4)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.