As cited
Copy frozen at (site build).
vulnerabilities
CISA Adds One Known Exploited Vulnerability to Catalog
CISA added CVE-2026-110447, an OS command injection vulnerability in Collabora Online's built-in CODE Server, to its Known Exploited Vulnerabilities Catalog based on active exploitation evidence. The agency emphasized that federal agencies must prioritize patching high-risk vulnerabilities on publicly exposed assets under Binding Operational Directive 26-04, and encouraged all organizations to adopt risk-based vulnerability management practices.
Why it matters: Federal agencies must treat CVE-2026-110447 (CVSS 9.2) as a priority remediation target on exposed systems; all organizations should patch this actively exploited vulnerability to prevent total asset compromise.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CISA Adds One Known Exploited Vulnerability to Catalog
CISA added CVE-2026-110447, an OS command injection vulnerability in Collabora Online, to its Known Exploited Vulnerabilities Catalog based on active exploitation evidence. The vulnerability has a CVSS score of 9.2 and presents significant risk because successful exploitation grants total control of affected assets. Federal agencies must prioritize patching this and other KEV Catalog vulnerabilities under Binding Operational Directive 26-04.
Why it matters: Federal agencies and organizations running Collabora Online must immediately assess exposure and patch this actively exploited vulnerability; agencies are required to verify systems were not compromised before patching under BOD 26-04.
- Source published
- First seen by Cybersecurity Tracker