CVE-2026-110447: Critical Collabora Online RCE Added to CISA KEV — Immediate Patching and Detection Guide

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-110447 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation of a critical security flaw in Collabora Online – Built-in CODE Server. With a CVSS score of 9.2, this vulnerability represents an immediate and severe risk to organizations utilizing Collabora's online office suite for document collaboration and editing.

Collabora Online is a widely deployed open-source office suite used by enterprises, government agencies, and educational institutions for real-time document collaboration. The Built-in CODE (Collabora Online Development Edition) Server component is frequently integrated into content management systems, file sharing platforms, and private cloud environments. Given the widespread deployment of this software in environments handling sensitive documentation, the addition to the CISA KEV catalog signals that threat actors are actively weaponizing this vulnerability to compromise systems.

Organizations running vulnerable versions of Collabora Online must treat this as a priority-one patching event. The combination of a near-maximum CVSS score and confirmed active exploitation indicates that unpatched instances are likely being targeted for initial access, lateral movement, or data exfiltration.

Technical Analysis

Vulnerability Overview

CVE-2026-110447 affects the Collabora Online Built-in CODE Server, specifically impacting the core daemon responsible for handling document rendering and collaboration sessions. While specific technical details of the vulnerability remain closely guarded to prevent widespread exploitation, the 9.2 CVSS score indicates a network-exploitable flaw requiring no user interaction and low attack complexity.

The vulnerability resides in the coolwsd (Collabora Online WebSocket Daemon) service, which listens on TCP port 9980 by default. This service processes WebSocket connections and HTTP requests for document editing sessions. Successful exploitation likely allows remote attackers to execute arbitrary code within the context of the coolwsd process, typically running as the cool user or within a containerized environment.

Attack Vector and Impact

Based on the architecture of Collabora Online, exploitation of this vulnerability could provide attackers with:

1. Remote Code Execution: Direct execution of commands on the underlying host or container hosting the CODE server
2. Document Access: Unauthorized access to sensitive documents being edited or stored by the service
3. Lateral Movement: Pivot point into internal networks, particularly where Collabora Online is integrated with internal file shares or authentication systems
4. Persistence: Installation of webshells or backdoors within the document editing infrastructure

The built-in nature of the CODE Server means many organizations may not realize they are running vulnerable software, as it is often embedded within larger collaboration platforms or deployed as a standalone service without centralized management.

Exploitation Status

CISA's addition to the KEV catalog confirms active exploitation in the wild. While specific threat actor attribution has not been publicly disclosed, document collaboration platforms are frequently targeted by:

• Ransomware operators seeking initial access to corporate networks
• Nation-state actors targeting intellectual property and sensitive communications
• Cybercriminal groups specializing in data extortion

Organizations should assume that any internet-facing Collabora Online instance without current patches is actively being probed or compromised.

Detection & Response

SIGMA Rules

The following Sigma rules detect potential exploitation attempts and post-exploitation activity related to CVE-2026-110447. Deploy these to your SIEM and monitor for suspicious process spawning from the Collabora Online daemon.

---
title: Collabora Online coolwsd Suspicious Child Process Execution
id: 550d9a23-0f72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects suspicious child processes spawned by the Collabora Online coolwsd daemon, indicative of potential RCE exploitation via CVE-2026-110447.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://securityaffairs.com/201652/security/u-s-cisa-adds-collabora-online-flaw-to-its-known-exploited-vulnerabilities-catalog.html
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.003
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: '/coolwsd'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/php'
      - '/nc'
      - '/netcat'
      - '/ncat'
      - '/curl'
      - '/wget'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate administrative scripts or maintenance activities
  - Container health checks (rare)
level: high
---
title: Collabora Online coolwsd Network Connection to Suspicious Ports
id: 7a3f1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects network connections from coolwsd to suspicious ports commonly used for C2 or reverse shells, potentially indicating post-exploitation activity.
references:
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith: '/coolwsd'
    DestinationPort:
      - 4444
      - 4445
      - 5555
      - 6666
      - 7777
      - 8888
      - 9999
      - 1337
      - 31337
falsepositives:
  - Legitimate monitoring or management connections on non-standard ports
  - Development environments with custom configurations
level: medium

Microsoft Sentinel / Defender KQL

Deploy this KQL query in Microsoft Sentinel to hunt for suspicious process execution chains involving Collabora Online. This query leverages Syslog data ingested via CEF or the Syslog connector.

// Hunt for suspicious child processes of coolwsd indicating potential exploitation
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName =~ "coolwsd" or ProcessName contains "coolwsd"
| extend ParsedMessage = tostring(SyslogMessage)
| where ParsedMessage contains "sh" or ParsedMessage contains "bash" 
    or ParsedMessage contains "python" or ParsedMessage contains "curl"
    or ParsedMessage contains "wget" or ParsedMessage contains "nc"
| project TimeGenerated, Computer, ProcessName, SyslogMessage, SeverityLevel
| order by TimeGenerated desc

// Alternative: Using SecurityEvent for Windows hosts running Collabora (rare but possible)
SecurityEvent
| where TimeGenerated > ago(7d)
| where ParentProcessName contains "coolwsd"
| where Process contains "cmd" or Process contains "powershell" 
    or Process contains "sh" or Process contains "bash"
| project TimeGenerated, Computer, Account, Process, CommandLine, ParentProcessName

Velociraptor VQL

For DFIR teams using Velociraptor, this VQL artifact hunts for evidence of exploitation on Linux endpoints running Collabora Online.

-- Hunt for suspicious processes spawned by coolwsd
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime, PPid
FROM pslist()
WHERE CommandLine =~ 'coolwsd'
   OR Exe =~ 'coolwsd'
   OR Name =~ 'coolwsd'

-- Check for network connections from coolwsd to external IPs
SELECT Pid, Name, Path, LocalAddr, LocalPort, RemoteAddr, RemotePort, State
FROM netstat()
WHERE Name =~ 'coolwsd'
  AND RemoteAddr !~ '^127\.'
  AND RemoteAddr !~ '^10\.'
  AND RemoteAddr !~ '^192\.168\.'
  AND RemoteAddr !~ '^172\.(1[6-9]|2[0-9]|3[0-1])\.'
  AND State =~ 'ESTABLISHED'

Remediation Script

Use the following Bash script to verify your Collabora Online installation status and apply necessary updates. Run this on all servers hosting Collabora Online CODE Server.

#!/bin/bash
# CVE-2026-110447 Remediation Script for Collabora Online
# Checks installation and provides update guidance

echo "=== Collabora Online CVE-2026-110447 Verification ==="
echo ""

# Check if coolwsd is installed
if command -v coolwsd &> /dev/null; then
    echo "[+] coolwsd found at: $(which coolwsd)"
    
    # Attempt to get version information
    echo "[+] Attempting to determine version..."
    coolwsd --version 2>/dev/null || echo "Version check failed - manual verification required"
    
    # Check service status
    if systemctl is-active --quiet coolwsd; then
        echo "[!] WARNING: coolwsd service is currently RUNNING"
        echo "[!] Immediate action required"
    else
        echo "[+] coolwsd service is not running"
    fi
    
    echo ""
    echo "=== IMMEDIATE ACTIONS REQUIRED ==="
    echo "1. STOP the service immediately if internet-facing:"
    echo "   sudo systemctl stop coolwsd"
    echo ""
    echo "2. Update Collabora Online to the latest patched version:"
    echo "   For Debian/Ubuntu:"
    echo "     sudo apt update && sudo apt upgrade collabora-online"
    echo "   For RHEL/CentOS:"
    echo "     sudo yum update collabora-online"
    echo "   For Docker:"
    echo "     docker pull collabora/code:latest"
    echo "     docker-compose up -d"
    echo ""
    echo "3. Verify patch level after update:"
    echo "   Ensure version is 25.04.4.1 or later (or latest available)"
    echo ""
    echo "4. Check for indicators of compromise:"
    echo "   Review /var/log/syslog or journalctl -u coolwsd for suspicious child processes"
    echo "   Check network connections: ss -tulnp | grep coolwsd"
    
else
    echo "[+] coolwsd not found - system may not be affected"
    echo "[+] Verify if Collabora Online is installed via alternative methods (Docker, Snap, etc.)"
fi

echo ""
echo "=== Network Exposure Check ==="
# Check if port 9980 is listening
if netstat -tuln 2>/dev/null | grep -q ':9980 ' || ss -tuln 2>/dev/null | grep -q ':9980 '; then
    echo "[!] WARNING: Port 9980 (default Collabora Online port) is LISTENING"
    echo "[!] Ensure this is not exposed to the internet without proper patching"
else
    echo "[+] Port 9980 is not currently listening"
fi

Remediation

Immediate Actions

Patch Immediately: Update Collabora Online to the latest available version. While specific patched version numbers may vary by distribution channel, ensure you are running the most recent release from official repositories. For the Built-in CODE Server, version 25.04.4.1 or later is recommended, though verify against the official Collabora advisory for the specific patched version addressing CVE-2026-110447.

CISA Deadline: Federal civilian executive branch agencies must remediate this vulnerability within 21 days of the KEV addition date (by April 27, 2026). While private sector organizations are not bound by this deadline, treat this as a critical SLA.

Specific Mitigation Steps

1. Verify Exposure: Determine if your Collabora Online instance is accessible from the internet. If so, immediately restrict access via firewall rules or take the service offline until patched.

2. Apply Updates:

   • Docker Deployments: Pull the latest image (collabora/code:latest) and recreate containers
   • Package-based Installations: Update via package manager (apt, yum, zypper)
   • Manual Installations: Download the latest release from the official Collabora website

3. Access Controls: If patching cannot occur immediately, implement network-level restrictions:

   • Restrict TCP port 9980 to trusted internal IP ranges only
   • Implement Web Application Firewall (WAF) rules to filter malicious requests
   • Place Collabora Online behind an authenticated reverse proxy

4. Verification: After patching, verify the coolwsd service is running the updated version and check logs for any signs of pre-patch compromise.

Long-term Hardening

• Network Segmentation: Isolate document collaboration services in dedicated VLANs with strict egress filtering
• Monitoring: Deploy the Sigma rules provided above to detect anomalous process spawning from coolwsd
• Vulnerability Management: Implement automated scanning for Collabora Online instances across your environment, as this software is often deployed by individual departments without central IT knowledge

References

• CISA Known Exploited Vulnerabilities Catalog
• Collabora Online Security Advisories
• Original News Source

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub