LUCAMEThe US Cybersecurity and Infrastructure Security Agency has added a newly identified vulnerability in Collabora Online to its list of security flaws known to be actively exploited in the wild. The flaw, tracked as CVE-2026-110447, allows an attacker to inject and run operating system commands through the built-in CODE server that ships with Collabora Online. This category of vulnerability is consistently used by threat actors to gain unauthorised access to systems.
What this means for your business
If your business uses Collabora Online for document editing or collaboration, you should check with your IT team or provider whether your installation is up to date and apply any available security patches without delay. Running an unpatched version exposes your systems to remote code execution, which could allow an attacker to take control of the affected server. If you are unsure whether Collabora Online is in use in your environment, now is a good time to ask.