The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a flaw in Collabora Online's built-in CODE Server to its Known Exploited Vulnerabilities (KEV) catalog — a listing that signals the bug is not merely theoretical but has been observed in real-world attacks.
Tracked as CVE-2026-110447 and carrying a CVSS base score of 9.2, the vulnerability affects Collabora Online – Built-in CODE Server, the document-editing component that many self-hosted productivity platforms embed to provide browser-based office functionality. Operators verifying the identifier should confirm it against the primary CISA KEV record, as the six-digit sequence deviates from the usual CVE format. The addition was reported by Security Affairs.
Why the listing matters more than the score
A 9.2 rating already puts the flaw in serious territory, though the score alone tells administrators little about how an attacker gets in: neither CISA's KEV entry nor Security Affairs' coverage specifies the attack vector, so the rating is best read as pointing to a flaw reachable over the network rather than as confirmation of any particular exploitation method.
What changes the risk calculus is the KEV listing itself. Inclusion falls under CISA's Binding Operational Directive 22-01, which obliges U.S. federal agencies to remediate listed vulnerabilities within a defined deadline. For everyone else — enterprises, universities, hosting providers, and individuals running their own stacks — the directive does not apply as a mandate, but it functions as a strong signal: this bug is being used, and the federal remediation clock set by BOD 22-01 is already running.
The inventory problem
The practical difficulty with this particular vulnerability is discovery rather than patching. Collabora's built-in CODE server is routinely bundled into larger self-hosted suites — the kind of Nextcloud-style deployments where an administrator may not realize a third-party editor component is running underneath the interface. Dependencies like this are easy to miss in a routine audit.
Operators should work through three questions in order: is a Collabora Online CODE server present in the environment at all; is the instance reachable from the internet or only from an internal network; and does the installed build match Collabora's officially fixed release? The authoritative source for both the required remediation date and the patched version numbers remains Collabora's vendor advisory and CISA's KEV entry for CVE-2026-110447 — those should be checked directly rather than relying on secondary summaries.
A signal, not a mandate
It is worth being precise about BOD 22-01's reach: it binds U.S. federal agencies, not private operators or overseas deployments. Outside that scope, the KEV list is best treated as curated intelligence — a vetted, high-confidence marker of active exploitation that can be folded into existing patch-priority workflows rather than a compliance obligation.
That distinction matters for procurement and risk discussions. Organizations evaluating self-hosted productivity platforms for data-sovereignty reasons — keeping documents inside a particular jurisdiction or under their own cryptographic control — increasingly weigh how quickly a vendor ships fixes for embedded open-source components. A CVE appearing on the KEV list is a concrete, third-party-validated data point for that assessment: it indicates both that the flaw is serious enough to attract exploitation and that the vendor's disclosure and patching cadence is now on public record.
Operators outside the directive's scope — including Hong Kong and other regional deployments of self-hosted Nextcloud or Collabora stacks — should treat the listing as procedural input rather than a compliance trigger, and check their own sector's requirements separately. The practical steps remain the same: confirm the component, confirm its exposure, and align the patch with Collabora's published fix, using the KEV listing as justification for moving the work up the queue.
美國網絡安全及基礎設施安全局（CISA）已將 Collabora Online 內置 CODE Server 的一項漏洞，列入其「已知遭利用漏洞」（Known Exploited Vulnerabilities，KEV）目錄 —— 該名單意味著此漏洞並非純屬理論風險，而是已在實際攻擊中被觀察到。
該漏洞編號為 CVE-2026-110447，CVSS 基準評分為 9.2，影響 Collabora Online – Built-in CODE Server，即許多自設伺服器（self-hosted）生產力平台所嵌入的文件編輯組件，用以提供基於瀏覽器的辦公室軟件功能。營運者如需核實該編號，應對照 CISA KEV 的主要記錄，因為其六位數字序列偏離一般 CVE 格式。有關新增列名的消息由 Security Affairs 報導。
為何列入名單比評分更值得注意
9.2 的評分已將此漏洞列為嚴重級別，然而單看評分，管理員對攻擊者如何入侵所知甚少：無論 CISA 的 KEV 條目還是 Security Affairs 的報道，均未指明攻擊向量（attack vector），因此該評分最好理解為指向一個可透過網絡觸達的漏洞，而非證實某種特定的利用方式。
真正改變風險計算的，是 KEV 名單本身。列入名單依據 CISA 的《具約束性行動指令 22-01》（Binding Operational Directive 22-01，BOD 22-01），該指令規定美國聯邦機構須在指定期限內修補名單上的漏洞。至於其他所有人 —— 企業、大學、託管服務供應商以及自行運行技術組合的個人 —— 該指令並非強制要求，但可視為一個強烈信號：此漏洞正遭利用，而 BOD 22-01 所設定的聯邦修補期限倒數已經啟動。
資產盤點難題
此漏洞在實務上的困難在於發現，而非修補。Collabora 內置 CODE server 通常會被整合進較大型的自設伺服器套件之中 —— 例如 Nextcloud 類型的部署，管理員可能並未察覺介面底下正運行著一個第三方編輯器組件。這類依賴關係在例行審計中很容易被忽略。
營運者應按次序釐清三個問題：環境中究竟是否存在 Collabora Online CODE server；該實例是可從互聯網訪問，還是僅限內網訪問；以及已安裝的版本是否符合 Collabora 官方已修復的版本？無論是要求的修補期限還是已修補的版本號，權威資料來源仍是 Collabora 的廠商安全公告，以及 CISA 就 CVE-2026-110447 的 KEV 條目 —— 應直接查核這些一手資料，而非依賴二手摘要。
屬信號，非強制要求
就 BOD 22-01 的適用範圍而言，須加以明確界定：該指令約束的是美國聯邦機構，而非私營營運者或境外部署。在此範圍之外，KEV 名單最好視為經整理的情報 —— 一個經審核、高可信度的活躍利用指標，可納入現有的修補優先次序工作流程，而非合規義務。
這一區別對採購及風險評估討論十分重要。出於數據主權（data sovereignty）考慮而評估自設伺服器生產力平台的機構 —— 例如要求文件留在特定司法管轄區內，或由自身掌控加密密鑰 —— 越來越重視廠商為嵌入式開放源碼組件發布修復的速度。某項 CVE 出現在 KEV 名單上，正是該評估中一個具體且經第三方驗證的數據點：它既表明漏洞嚴重到足以招致利用，也表明廠商的披露與修補節奏如今已有公開紀錄可查。
指令適用範圍以外的營運者 —— 包括香港及其他地區自設 Nextcloud 或 Collabora 技術組合的部署 —— 應將該列名視為程序性參考輸入，而非合規觸發條件，並就本身所屬範疇的規定另行查核。實際步驟始終一致：確認該組件是否存在、確認其對外暴露程度，並使修補對應 Collabora 已公布的修復版本，以 KEV 列名作為將工作提前處理的理據。