OS Command Injection in Collabora Online (CVE‑2026‑110447) Added to CISA KEV Catalog
What It Is — A command‑injection flaw in Collabora Online’s built‑in CODE Server allows an attacker to execute arbitrary OS commands on the host. The vulnerability is confirmed to be actively exploited in the wild.
Exploitability — Public evidence of exploitation; CISA has placed it in the Known Exploited Vulnerabilities (KEV) catalog. CVSS not yet published, but the impact (total control of the asset) warrants a high severity rating.
Affected Products — Collabora Online (CODE Server component).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for a Vulnerability Management control objective that spans identification, risk‑based prioritization, and rapid remediation.
- One satisfied vulnerability‑management control provides evidence for multiple frameworks (e.g., NIST CSF Identify, ISO 27001 A.12.6, SOC 2 CC6).
- Continuous monitoring of patch status and documented remediation creates a defensible audit trail that federal and enterprise buyers increasingly demand.
Recommended Actions
- Inventory all Collabora Online deployments and verify version exposure.
- Prioritize patching per BOD 26‑04; apply the vendor‑released fix or mitigate with network segmentation.
- Record remediation evidence (patch version, date, verification) in a centralized Trust Center for audit readiness.
- Update your vulnerability‑management process to flag any future KEV additions automatically.
Source: CISA Advisory – 23 Oct 2026