CVE-2026-110447
CWE-78
Final Priority
High86.1
Raw RPSRPS range: 0–105; KEV-listed vulnerabilities can receive an exploitation amplifier.
Description
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.
Source: NVD
Signals
- CVSS
- 9.2
- Critical · v4.0
- EPSS
- 1.22%
- Probability of exploitation in the next 30 days (FIRST) · Percentile: 68.6%
- CISA KEV
- In CISA KEV since Oct 2026
- Confirmed exploitation in the wild (CISA KEV)
- Upstream fix commit
- No verified fix commit in DevSecure data
- Sources: MoreFixes, FreshFixes
- SSVC inputs (CISA)
- Exploitation: Active · Automatable: Yes · Technical impact: Total
- CISA's assessed SSVC inputs, not a decision. A decision also needs your mission and public well-being context. Context only; not part of the RPS score.
- Weakness
- CWE-78
- Published
- 14 Oct 2026
- Last modified 23 Oct 2026
How to read these signals: RPS · EPSS · CISA KEV · Data sources
What would change this priority?
- ↑Would become Critical if the EPSS percentile reaches 77.4%, raising the raw RPS to 90 or more.
- •Stays at least High while it is in CISA KEV (KEV floor).
Explains the published RPS formula and priority rules; it doesn't change the score. How priority works
Get this score from the API
curl -H "Authorization: Bearer dsec_live_xxxxxxxx" \
https://api.intelligence.devsecure.io/api/v1/rps/CVE-2026-110447Replace the placeholder with your key. Get a free API key or rank your own CVEs.
Data as of 24 Oct 2026, 05:17 UK time
This product uses the NVD API but is not endorsed or certified by the NVD. Data sources and licences