The US Cybersecurity and Infrastructure Security Agency (CISA) said on 23 October that it added one flaw to its Known Exploited Vulnerabilities (KEV) catalog. The catalog is a public list of flaws that attackers are using. CISA said it has evidence of active exploitation. The flaw is CVE-2026-110447, an OS command injection bug in the built-in CODE Server of Collabora Online. Command injection lets an attacker make a system run commands it should not. CISA said this type of flaw is a common route for attackers and a serious risk to the federal enterprise.
The notice does not say who is exploiting the flaw or how many systems are affected. It does not list affected versions, say whether a fix exists, or set a deadline. CISA pointed to its directive BOD 26-04. That rule tells federal civilian agencies to fix KEV-listed flaws first when the system is exposed to the public and an attacker would gain full control. It also sets when agencies must check for earlier compromise. The directive applies only to those agencies.
Anyone who runs Collabora Online can check whether they use the built-in CODE Server. CISA urges all organisations, not just federal agencies, to put KEV-listed fixes first.