CISA KEV adds Collabora Online command injection flaw
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
CISA added CVE-2026-110447, an actively exploited OS command injection flaw in Collabora Online's built-in CODE server, to its KEV catalog.
CISA has added CVE-2026-110447 to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. The vulnerability affects Collabora Online's built-in CODE (Collabora Online Development Edition) Server and is classified as an OS command injection flaw, which could allow an attacker to execute arbitrary commands on the underlying operating system, potentially granting significant control over affected assets.
Per Binding Operational Directive (BOD 26-04), Federal Civilian Executive Branch (FCEB) agencies are required to prioritize remediation of KEV-listed vulnerabilities on publicly exposed assets, particularly those that grant total control post-exploitation, and to check for prior compromise before patching. While BOD 26-04 is mandatory only for FCEB agencies, CISA recommends all organizations running Collabora Online with the built-in CODE server identify affected instances, apply vendor patches promptly, and investigate for signs of compromise predating remediation.
No further technical details, exploit specifics, or threat actor attribution were provided in this bulletin. Defenders should consult Collabora's advisories for patched versions and monitor for anomalous command execution on systems running the CODE server component.
Mentioned in this report
Detection guidance
Collabora Online Server Process Spawning Shell
Collabora Online CODE server daemon (coolwsd/loolwsd/coolforkit) spawning a shell, consistent with OS command injection exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Collabora Online Server Process Spawning Shell
description: Detects the Collabora Online (CODE) server daemon or its fork helper
spawning an interactive or command shell with -c. The server normally does not launch
shells, so this is consistent with OS command injection exploitation of the service.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /coolwsd
- /loolwsd
- /coolforkit
- /loolforkit
- /coolforkit-caps
- /coolforkit-ns
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /zsh
- /ash
condition: selection_parent and selection_child
falsepositives:
- Administrator debugging sessions that start a shell under the Collabora service
account
- Custom wrapper or init scripts that launch coolwsd through a shell and are recorded
with the daemon as parent
level: high
id: 41ce0c3d-8bc8-548f-b79b-123da6d49e78
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog-0
Collabora Online Server Process Spawning Recon or Download Utilities
Collabora Online CODE server daemon spawning download, reverse-shell or recon utilities, indicating post-exploitation command execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Collabora Online Server Process Spawning Recon or Download Utilities
description: Detects the Collabora Online (CODE) server daemon or fork helper directly
launching network download, reverse-shell or reconnaissance utilities, typical of
post-exploitation after command injection.
tags:
- attack.execution
- attack.t1059.004
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /coolwsd
- /loolwsd
- /coolforkit
- /loolforkit
- /coolforkit-caps
- /coolforkit-ns
selection_child:
Image|endswith:
- /curl
- /wget
- /nc
- /ncat
- /netcat
- /socat
- /whoami
- /id
- /uname
- /python
- /python3
- /perl
- /busybox
condition: selection_parent and selection_child
falsepositives:
- Vendor diagnostic or health-check scripts that call curl or id from the Collabora
service
- Administrators running troubleshooting commands from a service-account context
level: high
id: 6efc6257-1ff3-55f7-b32a-d933c271ce01
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog-0
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog-0
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,087 reports from 142 sources, 545 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs