CISA adds Collabora Online command injection vulnerability to KEV catalog

The Cybersecurity and Infrastructure Security Agency added an OS command injection flaw affecting Collabora Online to its Known Exploited Vulnerabilities catalog on October 23, 2026. CISA Alerts reported that the vulnerability, tracked as CVE-2026-110447, exists in the built-in CODE Server component. CISA confirmed that the flaw was added based on evidence of active exploitation in the wild. [1]

According to CISA Alerts, OS command injection flaws represent a frequent attack vector for malicious actors and pose significant security risks to network infrastructure. The agency noted that such flaws allow attackers to execute unauthorized commands on underlying operating systems. CISA did not disclose specific details regarding the threat groups involved or the scope of current attacks. [1]

Federal Civilian Executive Branch agencies must remediate the vulnerability under Binding Operational Directive 26-04. As FTMQ Security reported earlier, the directive establishes mandatory vulnerability management requirements and instructs federal organizations to prioritize updates based on the risk posed by cataloged security flaws. [1][5]

The addition follows previous updates to the catalog earlier in the month. As FTMQ Security reported earlier, CISA added four other vulnerabilities to the catalog on October 14, 2026, including flaws in Palo Alto Networks PAN-OS and Cisco Secure Email Gateway. Federal agencies are required to carry out rapid remediation of all vulnerabilities listed in the catalog. [1][5]