Collabora · Code execution
This is rated critical severity (9.2 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Collabora Collabora Online Built In Code Server is in your estate, and treat that as the priority.
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.
Exploitable over the network without any account, under specific conditions, and no one has to click or open anything. High impact on confidentiality, integrity and availability.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Exploitability
Longer bar: easier to attack
Impact
Longer bar: more harm
3 links from the CVE record, grouped by site; the vendor's advisory comes first.
help.nextcloud.com1 linkVendor advisory
github.com1 link
cisa.gov1 link
CISA has added one new vulnerability to its known-exploited catalogue, based on evidence of active exploitation.
Next step: Confirm whether Collabora Online - Built-in Code Server is in your estate.
Who's reporting
1 of 3 perspectives
Official authority: Official 2Vendor statement missing. no VendorResearcher coverage missing. no Researcher2 signals
Only official coverage so far. Treat as an early signal.
