🚨 Rapid Response | Collabora Online Built-in CODE Server OS Command Injection (CVE-2026-110447) (CVSS 9.2) is a critical OS command injection vulnerability affecting the Collabora Online Built-in CODE Server app for Nextcloud. Exploitation in the wild has been reported, allowing unauthenticated attackers to execute operating system commands.
Censys currently detects 19,454 Internet-exposed hosts and 103,350 web properties with the app installed. These figures represent detected installations, not confirmed vulnerable instances.
Organizations should upgrade to version 26.4.303 or later, or remove the app. Disabling it is not sufficient.
Full Censys ARC advisory, including affected versions, exploitation indicators, and remediation guidance: censys.com/advisory/…
