# CISA KEV adds Collabora Online command injection flaw

Published: 2026-10-23 · Severity: high · Sectors: Government (National), Technology
Canonical: https://vorant.io/reports/95fbde8c-8008-52da-9f58-1f737a652638/cisa-kev-adds-collabora-online-command-injection-flaw

> CISA added CVE-2026-110447, an actively exploited OS command injection flaw in Collabora Online's built-in CODE server, to its KEV catalog.

CISA has added CVE-2026-110447 to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. The vulnerability affects Collabora Online's built-in CODE (Collabora Online Development Edition) Server and is classified as an OS command injection flaw, which could allow an attacker to execute arbitrary commands on the underlying operating system, potentially granting significant control over affected assets.

Per Binding Operational Directive (BOD 26-04), Federal Civilian Executive Branch (FCEB) agencies are required to prioritize remediation of KEV-listed vulnerabilities on publicly exposed assets, particularly those that grant total control post-exploitation, and to check for prior compromise before patching. While BOD 26-04 is mandatory only for FCEB agencies, CISA recommends all organizations running Collabora Online with the built-in CODE server identify affected instances, apply vendor patches promptly, and investigate for signs of compromise predating remediation.

No further technical details, exploit specifics, or threat actor attribution were provided in this bulletin. Defenders should consult Collabora's advisories for patched versions and monitor for anomalous command execution on systems running the CODE server component.

## Mentioned in this report

- Vulnerabilities: CVE-2026-110447 (KEV)

## Detection guidance (public sample)

### Collabora Online Server Process Spawning Shell

ATT&CK: T1190

Collabora Online CODE server daemon (coolwsd/loolwsd/coolforkit) spawning a shell, consistent with OS command injection exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Collabora Online Server Process Spawning Shell
description: Detects the Collabora Online (CODE) server daemon or its fork helper
  spawning an interactive or command shell with -c. The server normally does not launch
  shells, so this is consistent with OS command injection exploitation of the service.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /coolwsd
    - /loolwsd
    - /coolforkit
    - /loolforkit
    - /coolforkit-caps
    - /coolforkit-ns
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /zsh
    - /ash
  condition: selection_parent and selection_child
falsepositives:
- Administrator debugging sessions that start a shell under the Collabora service
  account
- Custom wrapper or init scripts that launch coolwsd through a shell and are recorded
  with the daemon as parent
level: high
id: 41ce0c3d-8bc8-548f-b79b-123da6d49e78
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog-0
```

### Collabora Online Server Process Spawning Recon or Download Utilities

ATT&CK: T1059.004

Collabora Online CODE server daemon spawning download, reverse-shell or recon utilities, indicating post-exploitation command execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Collabora Online Server Process Spawning Recon or Download Utilities
description: Detects the Collabora Online (CODE) server daemon or fork helper directly
  launching network download, reverse-shell or reconnaissance utilities, typical of
  post-exploitation after command injection.
tags:
- attack.execution
- attack.t1059.004
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /coolwsd
    - /loolwsd
    - /coolforkit
    - /loolforkit
    - /coolforkit-caps
    - /coolforkit-ns
  selection_child:
    Image|endswith:
    - /curl
    - /wget
    - /nc
    - /ncat
    - /netcat
    - /socat
    - /whoami
    - /id
    - /uname
    - /python
    - /python3
    - /perl
    - /busybox
  condition: selection_parent and selection_child
falsepositives:
- Vendor diagnostic or health-check scripts that call curl or id from the Collabora
  service
- Administrators running troubleshooting commands from a service-account context
level: high
id: 6efc6257-1ff3-55f7-b32a-d933c271ce01
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog-0
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog-0

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/95fbde8c-8008-52da-9f58-1f737a652638/cisa-kev-adds-collabora-online-command-injection-flaw.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup