Ethical Hacking News
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Collabora Online flaw to its Known Exploited Vulnerabilities catalog, warning users of a significant vulnerability that could be exploited by malicious actors. The CVE-2026-110447 vulnerability has a CVSS score of 9.2 and allows unauthenticated attackers to execute OS commands on systems when the built-in server is stopped. Users are advised to update to version 26.4.303 immediately and remove leftover shx*.php files to protect themselves against this threat.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Collabora Online flaw to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability, CVE-2026-110447, has a CVSS score of 9.2, indicating a significant threat to users. The flaw is a critical OS command injection vulnerability in Nextcloud's proxy.php that affects Collabora Online Built-in CODE Server versions up to 26.4.303. Standalone Collabora servers are not affected by this vulnerability. Users are advised to update to version 26.4.303 immediately and remove leftover shx*.php files. CISA has issued an order for federal agencies to fix the flaw by October 26, 2026.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently added a critical Collabora Online flaw to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability, designated as CVE-2026-110447, has a CVSS score of 9.2, indicating that it poses a significant threat to users. This development serves as a stark reminder of the ever-evolving threat landscape in the digital realm, where vulnerabilities can be exploited by malicious actors to gain unauthorized access to systems and data.
Collabora Online – Built-in CODE Server is a widely used application for Nextcloud, allowing users to open, edit, and collaborate on documents, spreadsheets, and presentations directly in their web browsers. This feature relies on Collabora Online and LibreOffice technology, making it a staple in the realm of office productivity. However, like any other software, Collabora Online – Built-in CODE Server is not immune to security threats.
The CVE-2026-110447 vulnerability is a critical OS command injection flaw in Nextcloud’s proxy.php that affects Collabora Online Built-in CODE Server versions up to 26.4.303. This vulnerability enables unauthenticated attackers to execute commands on the system when the built-in server is stopped, such as during a restart, upgrade, or crash. Standalone Collabora servers are not affected by this vulnerability.
The flaw was first reported by three administrators on GitHub, who identified a Bash command injection vulnerability in proxy.php that allowed attackers to execute OS commands as the web server user. This vulnerability has been reported since September 2026, with attackers deploying PHP web shells and stealing configuration files containing credentials and application secrets. The first recorded attack dates back to September 10, 2026, with malicious requests targeting proxy.php on version 26.4.302. Logs showed that the attackers deployed a PHP web shell and searched for servers with credential stores and cryptocurrency wallets. Although reviewed logs showed no file exfiltration commands, data accessible to the web server account must be considered potentially exposed.
In response to this vulnerability, experts recommend that users update to version 26.4.303 immediately and remove leftover shx*.php files. CISA has also issued an order for federal agencies to fix the flaw by October 26, 2026. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities emphasizes the importance of addressing identified vulnerabilities by the due date to protect networks against attacks exploiting the flaws in the catalog. Private organizations are also advised to review the Known Exploited Vulnerabilities catalog and address the vulnerabilities in their infrastructure.
This recent development serves as a stark reminder of the importance of staying vigilant in the face of evolving cybersecurity threats. As technology continues to advance at an unprecedented pace, it is imperative that we prioritize security and take proactive measures to protect ourselves and our organizations from such vulnerabilities. By doing so, we can mitigate the risk of attacks and safeguard our digital assets against malicious actors.
Related Information:
https://www.ethicalhackingnews.com/articles/The-US-Cybersecurity-Community-Soundly-Warns-of-a-New-Collabora-Online-Vulnerability-as-CISA-Adds-It-to-Its-Catalog-ehn.shtml
https://securityaffairs.com/201652/security/u-s-cisa-adds-collabora-online-flaw-to-its-known-exploited-vulnerabilities-catalog.html
https://nvd.nist.gov/vuln/detail/CVE-2026-110447
https://www.cvedetails.com/cve/CVE-2026-110447/
Published: Sat Oct 24 13:21:45 2026 by llama3.2 3B Q4_K_M
