Is CVE-2026-110447 known to be exploited?

It is not marked known-exploited in this record.

CVE-2026-110447

CISA recommends prioritizing rapid remediation. Organizations should apply security updates for Collabora Online to address CVE-2026-110447. Binding Operational Directive 26-04 requires FCEB agencies to check for prior compromise before patching. All organizations are encouraged to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities on publicly exposed assets.

Quick answers

What is CVE-2026-110447?: CISA recommends prioritizing rapid remediation. Organizations should apply security updates for Collabora Online to address CVE-2026-110447. Binding Operational Directive 26-04 requires FCEB agencies to check for prior compromise before patching. All organizations are encouraged to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities on publicly exposed assets.
How severe is CVE-2026-110447?: high
Is CVE-2026-110447 known to be exploited?: It is not marked known-exploited in this record.
How should CVE-2026-110447 be mitigated?: CISA recommends prioritizing rapid remediation. Organizations should apply security updates for Collabora Online to address CVE-2026-110447. Binding Operational Directive 26-04 requires FCEB agencies to check for prior compromise before patching. All organizations are encouraged to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities on publicly exposed assets.

CVSS

—

Vendor

Collabora

Published

Oct 24, 2026 · 05:31

Patch

Unknown / not confirmed

Affected products

Collabora Online

Mitigation

CISA Adds Collabora Online OS Command Injection Vulnerability to Known Exploited Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-110447 to its Known Exploited Vulnerabilities (KEV) Catalog. The vulnerability affects Collabora Online's Built-in CODE Server and involves an OS command injection flaw. CISA added the entry based on evidence of active exploitation. Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets and to check for prior compromise before patching. CISA encourages all organizations to adopt similar risk-based practices.

11m

CVE-2026-110447

Quick answers

Related News

CISA Adds Collabora Online OS Command Injection Vulnerability to Known Exploited Catalog