Swiss SME Cyber Alert: ONLYOFFICE Docs – actively exploited server flaw allows code execution
CISA has confirmed active exploitation of a critical vulnerability in older ONLYOFFICE Document Server installations. Versions earlier than 5.6.3 are affected when JWT is used. If your company runs ONLYOFFICE Docs itself or through an IT provider, ask for the installed version to be checked today.
What happened?
CISA added CVE-2021-3199 to its Known Exploited Vulnerabilities catalogue on 8 October 2026. This confirms that attackers are using the vulnerability in real-world incidents.
The vulnerability is in the upload function of ONLYOFFICE Document Server. A remote attacker can use a manipulated image-upload request to traverse file paths and execute code on the server without signing in, when JWT is in use.
Could my company be affected?
The issue affects ONLYOFFICE Document Server, also known as ONLYOFFICE Docs, before version 5.6.3. This is relevant to self-hosted installations and servers managed by an IT provider as part of a document or collaboration platform.
If your company does not use ONLYOFFICE Docs, or its Document Server is running version 5.6.3 or later, this specific vulnerability does not apply according to the official information.
What should you do now?
Ask your IT provider today to identify any self-hosted or managed ONLYOFFICE Document Server, then verify its version, JWT configuration, and internet exposure.
Affected systems should be upgraded to a currently supported release; version 5.6.3 is the minimum release containing the fix.
If a vulnerable server was reachable from the internet, ask for a review of logs and system state for signs of compromise.
How urgent is it?
High for affected, reachable servers. Active exploitation is confirmed and an unauthenticated attack can lead to code execution, so the check should not wait for the next routine maintenance window.
Information for your IT provider
CVE: CVE-2021-3199; CVSS 3.1: 9.8.
Product: ONLYOFFICE Document Server / ONLYOFFICE Docs before version 5.6.3.
Precondition: JWT is used; attack through a crafted image-upload request in the /upload function.
Impact: security restriction bypass and remote code execution.
Status: active exploitation confirmed; added to CISA KEV on 8 October 2026.
Remediation: upgrade to a currently supported release, at minimum 5.6.3; assess exposed legacy systems for compromise.
