CISA Updates Known Exploited Vulnerabilities Catalog with Collabora Online Flaw
Critical Vulnerability Added to CISA KEV Catalog
The Cybersecurity and Infrastructure Security Agency (CISA) has officially expanded its Known Exploited Vulnerabilities (KEV) Catalog, adding a high-risk security flaw identified as CVE-2026-110447. This specific vulnerability affects the Collabora Online Built-in CODE Server and is classified as an OS Command Injection vulnerability. The inclusion follows confirmed reports of active exploitation in the wild, prompting CISA to mandate immediate attention from federal entities.
Understanding the Risk and Remediation Requirements
The addition of CVE-2026-110447 to the KEV Catalog triggers specific operational requirements for Federal Civilian Executive Branch (FCEB) agencies under Binding Operational Directive (BOD) 26-04. This directive emphasizes a risk-based approach to vulnerability management, prioritizing the remediation of flaws that grant attackers total control over compromised assets. Under the current guidelines, agencies are required to address these critical updates with urgency to mitigate the risk of unauthorized access and potential system takeover.
Furthermore, BOD 26-04 mandates that agencies perform thorough checks to determine whether their systems were compromised prior to the application of the necessary security patches. This proactive stance is intended to identify potential persistence or lateral movement by threat actors that may have occurred before the vulnerability was remediated.
Broadening the Scope of Vulnerability Management
While the mandates set forth by BOD 26-04 are legally binding only for federal agencies, CISA strongly urges private sector organizations and other stakeholders to adopt similar risk-based vulnerability management practices. By prioritizing the remediation of vulnerabilities listed within the KEV Catalog, organizations can significantly reduce their attack surface against known threats that are actively being leveraged by malicious actors.
CISA continues to maintain the KEV Catalog as a living resource for the security community. The agency encourages organizations that identify evidence of active exploitation for vulnerabilities not yet included in the list to submit their findings via the official CISA KEV Nomination Form. Submissions require a valid CVE ID, documented evidence of exploitation, and clear mitigation guidance to be considered for inclusion. As the threat landscape evolves, the KEV Catalog remains a vital tool for security professionals to align their patching priorities with real-world adversary activity.
