Patch Sonar: Office, email & file sharing https://patchsonar.com/tech/office Exploited vulnerabilities in office, email & file sharing, in plain English. en-us Collabora Collabora Online – Built-in CODE Server: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability https://patchsonar.com/cve/CVE-2026-110447 https://patchsonar.com/cve/CVE-2026-110447 Fri, 23 Oct 2026 12:00:00 GMT Office, email & file sharing Yes. CISA added this to its catalog of actively exploited vulnerabilities on Oct 23, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. ONLYOFFICE Docs: ONLYOFFICE Docs Server Path Traversal Vulnerability https://patchsonar.com/cve/CVE-2021-3199 https://patchsonar.com/cve/CVE-2021-3199 Thu, 08 Oct 2026 12:00:00 GMT Office, email & file sharing Yes. CISA added this to its catalog of actively exploited vulnerabilities on Oct 8, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. ProFTPD ProFTPD: ProFTPD Improper Access Control Vulnerability https://patchsonar.com/cve/CVE-2015-3306 https://patchsonar.com/cve/CVE-2015-3306 Thu, 08 Oct 2026 12:00:00 GMT Office, email & file sharing Yes. CISA added this to its catalog of actively exploited vulnerabilities on Oct 8, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. Microsoft SharePoint: Microsoft SharePoint Code Injection Vulnerability https://patchsonar.com/cve/CVE-2026-65660 https://patchsonar.com/cve/CVE-2026-65660 Fri, 25 Sep 2026 12:00:00 GMT Office, email & file sharing Yes. CISA added this to its catalog of actively exploited vulnerabilities on Sep 25, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. ownCloud ownCloud: ownCloud Improper Authentication Vulnerability https://patchsonar.com/cve/CVE-2023-49105 https://patchsonar.com/cve/CVE-2023-49105 Thu, 27 Aug 2026 12:00:00 GMT Office, email & file sharing Yes. CISA added this to its catalog of actively exploited vulnerabilities on Aug 27, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. Synacor Zimbra Collaboration Suite (ZCS): Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability https://patchsonar.com/cve/CVE-2026-73570 https://patchsonar.com/cve/CVE-2026-73570 Fri, 21 Aug 2026 12:00:00 GMT Office, email & file sharing Yes. CISA added this to its catalog of actively exploited vulnerabilities on Aug 21, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. TrueConf Server: TrueConf Server Code Injection Vulnerability https://patchsonar.com/cve/CVE-2026-72530 https://patchsonar.com/cve/CVE-2026-72530 Thu, 20 Aug 2026 12:00:00 GMT Office, email & file sharing Yes. CISA added this to its catalog of actively exploited vulnerabilities on Aug 20, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. TrueConf Server: TrueConf Server Missing Authentication for Critical Function Vulnerability https://patchsonar.com/cve/CVE-2026-72529 https://patchsonar.com/cve/CVE-2026-72529 Thu, 20 Aug 2026 12:00:00 GMT Office, email & file sharing Yes. CISA added this to its catalog of actively exploited vulnerabilities on Aug 20, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. Microsoft SharePoint: Microsoft SharePoint Weak Authentication Vulnerability https://patchsonar.com/cve/CVE-2026-55040 https://patchsonar.com/cve/CVE-2026-55040 Tue, 18 Aug 2026 12:00:00 GMT Office, email & file sharing Yes. CISA added this to its catalog of actively exploited vulnerabilities on Aug 18, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.