EN PT-BR
← Voltar ao feed
critical government

CISA adds actively exploited Collabora Online CODE Server OS command injection flaw (CVE-2026-110447) to KEV Catalog

2 fonte(s) · 2 atualização(ões) · publicado 23/10/2026 09:00 · coletado há 1 semana

CISA added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-10-23, citing evidence of active exploitation. The flaw, CVE-2026-110447 (CVSS 9.2), is an unauthenticated OS command injection vulnerability in the Built-in CODE Server of Collabora Online, a Nextcloud app. CISA describes this vulnerability class as a frequent attack vector for malicious cyber actors and a significant risk to the federal enterprise. Exploitation has been reported since September 2026, with attackers deploying PHP web shells and stealing configuration files with credentials and application secrets (securityaffairs.com). The first recorded attack was on September 10, and the total number of compromised servers is unknown. FCEB agencies must remediate by October 26, 2026 (securityaffairs.com).

Entenda a falha

A vulnerabilidade

CVE-2026-110447 (CVSS 9.2) is an unauthenticated OS command injection in the Built-in CODE Server of Collabora Online, a Nextcloud app, in the proxy.php script. A remote attacker needs no login, but the local CODE server must be stopped (restart, upgrade or crash). They can then run OS commands as the web server user. Versions up to 26.4.302 are affected and 26.4.303 fixes it. Standalone Collabora servers are not affected, and the flaw only concerns the Development Edition's Built-in CODE Server deployment. CISA added it to the KEV catalog on 2026-10-23.

Como funciona

A request reaches proxy.php, which runs directly through the web server without loading Nextcloud's own code. The script places data from the request into a Bash command without proper sanitization. While the local CODE server is running, the vulnerable path is not exploitable; when it is stopped, the request data ends up in the command and is executed with the web server user's privileges. In the reported attacks, this led to PHP web shells and theft of configuration files holding credentials and application secrets.

Por que é vulnerável

The root cause is missing input sanitization: proxy.php built a Bash command with request data without neutralizing it. A second factor is that the script runs standalone, outside Nextcloud's code and its protections, and the dangerous path is reachable when the local CODE server is stopped. The articles do not say why the flaw went unnoticed, and they do not detail what the 26.4.303 fix changes in the code.

Onde está

The flaw is in Nextcloud's proxy.php script of the Collabora Online Built-in CODE Server app, in versions up to 26.4.302; no function or commit is named in the articles.

Como foi descoberta

The flaw came to light through exploitation in the wild. Three administrators reported incidents on GitHub; the first was a Nextcloud administrator whose servers were compromised, with logs showing malicious requests against proxy.php on September 10 and 11, 2026, from the same IP. The CVE record confirms exploitation in September and October 2026, and CISA added the CVE to KEV on 2026-10-23. The articles do not say who first identified the underlying bug or how the vendor was notified. The number of compromised servers is unknown.

Explicação gerada por IA a partir da matéria e dos artigos, em 24/10/2026 16:21.

Detalhes técnicos

  • CVE-2026-110447: OS command injection in the Collabora Online Built-in CODE Server.
  • In versions up to 26.4.302, Nextcloud's proxy.php included request data in a Bash command without sanitization, allowing unauthenticated attackers to run OS commands as the web server user. It is exploitable only while the local CODE server is stopped (restart, upgrade or crash). Standalone Collabora servers are not affected (securityaffairs.com).
  • Three administrators reported incidents on GitHub. Logs showed malicious requests on September 10 and 11, 2026, from the same IP against proxy.php. Attackers deployed a PHP web shell and searched one server for credential stores and cryptocurrency wallets. No file exfiltration commands were seen, but data accessible to the web server account must be considered potentially exposed. No evidence of root access was found. One administrator saw another attempt on September 14 after updating, with no new shell (securityaffairs.com).
  • The CVE record confirms exploitation in September and October 2026 (securityaffairs.com).

Remediação

  • Update to 26.4.303 or later, and remove leftover shx*.php files, as urged by maintainer mmeeks (securityaffairs.com).
  • Treat data and secrets accessible to the web server account as potentially exposed, and rotate credentials (securityaffairs.com).
  • FCEB agencies must prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control post-exploitation. They must also check whether the system was compromised before the patch was applied.
  • CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV Catalog vulnerabilities.

Relatos divergentes

  • The earlier CISA alert coverage cites BOD 26-04 as the directive governing remediation. securityaffairs.com cites BOD 22-01. The earlier version comes from the CISA alert, which is the more authoritative source on this point.
  • The earlier report said no details on affected versions or patches were available. securityaffairs.com now gives affected versions (up to 26.4.302) and the fixed version (26.4.303), which is the more recent information.

Linha do tempo

  1. securityaffairs.com ↗ · pub. 24/10/2026 13:53 · coletado 24/10 15:00

    CISA adds Collabora Online CODE Server flaw CVE-2026-110447 to KEV after web shell attacks on Nextcloud servers

    The article adds technical and exploitation detail missing from the earlier CISA alert coverage: CVSS 9.2, unauthenticated command injection in Nextcloud's proxy.php, affected versions up to 26.4.302, fixed version 26.4.303, web shell deployment and config/credential theft since September 10, 2026, leftover shx*.php files, and the FCEB due date of October 26, 2026. It also cites BOD 22-01, whereas the known report cites BOD 26-04.

    ler a análise desta fonte

    The article adds technical and exploitation detail missing from the earlier CISA alert coverage: CVSS 9.2, unauthenticated command injection in Nextcloud's proxy.php, affected versions up to 26.4.302, fixed version 26.4.303, web shell deployment and config/credential theft since September 10, 2026, leftover shx*.php files, and the FCEB due date of October 26, 2026. It also cites BOD 22-01, whereas the known report cites BOD 26-04.

    CISA added CVE-2026-110447 (CVSS 9.2) to its Known Exploited Vulnerabilities (KEV) catalog. The flaw is an unauthenticated OS command injection in proxy.php of the Collabora Online Built-in CODE Server app for Nextcloud. Exploitation has been reported since September 2026. Attackers deployed PHP web shells and stole configuration files containing credentials and application secrets. The first recorded attack was on September 10, and the total number of compromised servers is unknown. Federal agencies must remediate by October 26, 2026.

    Technical Details

    • Versions up to 26.4.302 of the Built-in CODE Server include request data in a Bash command in proxy.php without sanitization. This allows command execution as the web server user.
    • The flaw is exploitable only while the local CODE server is stopped, for example during a restart, upgrade or crash. The script runs directly through the web server without loading Nextcloud code.
    • Standalone Collabora servers are not affected. Only the Development Edition's Built-in CODE Server deployment is.
    • Three administrators reported incidents on GitHub. Logs showed malicious requests on September 10 and 11, 2026, from the same IP against proxy.php on 26.4.302.
    • Attackers deployed a PHP web shell and searched one server for credential stores and cryptocurrency wallets. No file exfiltration commands were seen in the reviewed logs. Data readable by the web server account should still be treated as potentially exposed.
    • No administrator found evidence of root access. One recorded another attempt on September 14 after updating to 26.4.303, and no new shell appeared.
    • The CVE record confirms exploitation in September and October 2026.

    Remediation

    • Update immediately to 26.4.303 or later.
    • Remove leftover shx*.php files, as urged by maintainer mmeeks.
    • Treat web-server-accessible secrets as exposed, and rotate credentials and application secrets.
    • Under BOD 22-01, FCEB agencies must fix the flaw by October 26, 2026. Private organizations are advised to review the KEV catalog.
  2. cisa.gov ↗ · pub. 23/10/2026 09:00 · coletado 23/10 19:00 primeiro registro

    CISA adds actively exploited Collabora Online CODE Server OS command injection flaw (CVE-2026-110447) to KEV Catalog

    ler a análise desta fonte

    CISA added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-10-23, citing evidence of active exploitation. The flaw, CVE-2026-110447, is an OS command injection vulnerability in the Built-in CODE Server of Collabora Online. CISA describes this vulnerability class as a frequent attack vector for malicious cyber actors and a significant risk to the federal enterprise. The alert gives no details on the exploitation campaign, affected versions, patches or attribution.

    Technical Details

    • CVE-2026-110447: OS command injection in the Collabora Online Built-in CODE Server.
    • Exploitation is confirmed by CISA, but the article does not describe the method, the threat actors or the victims.

    Remediation

    • Under BOD 26-04, Federal Civilian Executive Branch (FCEB) agencies must prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control post-exploitation. They must also check whether the system was compromised before the patch was applied.
    • CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV Catalog vulnerabilities.
    • The article does not specify fixed versions or vendor guidance. Consult the Collabora advisory.