Are Collabora & ONLYOFFICE safe right now?
2 flaws were added to CISA's list of actively exploited vulnerabilities in the last 30 days. If you run Collabora & ONLYOFFICE, update now.
Exploited in the last 90 days
- Collabora Online – Built-in CODE ServerCollabora Online – Built-in CODE Server OS Command Injection Vulnerability
What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.
- DocsONLYOFFICE Docs Server Path Traversal Vulnerability
What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.
- Zimbra Collaboration Suite (ZCS)Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.
Earlier exploited flaws
- Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
- Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability
- Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability
- Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability
- Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
- Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability
- Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
- Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
- Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability Zero-day
- Citrix Content Collaboration ShareFile Improper Access Control Vulnerability
- Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability Zero-day
- Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
- Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
- Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability Zero-day
- Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
By year
| Year | Exploited flaws added | Zero-days |
|---|---|---|
| 2026 (so far) | 7 | 0 |
| 2025 | 4 | 0 |
| 2024 | 1 | 1 |
| 2023 | 3 | 1 |
| 2022 | 7 | 1 |
Questions
Are Collabora & ONLYOFFICE safe right now?
2 flaws were added to CISA's list of actively exploited vulnerabilities in the last 30 days. If you run Collabora & ONLYOFFICE, update now. Confirm with the vendor's own advisories and install updates as soon as they're available.
How many Collabora & ONLYOFFICE vulnerabilities have been exploited?
22 flaws are on CISA's list of vulnerabilities known to be exploited in real attacks, 6 of them used by ransomware.
Covers products matching collabora, onlyoffice. Sources: CISA's Known Exploited Vulnerabilities catalog and the vendors' own advisories. Updated every hour. General information only; confirm details with the vendor.