On 23 October 2026 CISA added CVE-2026-110447 to its catalogue of known exploited vulnerabilities. The flaw sits in the Collabora Online Built-in CODE Server app, which organisations install into Nextcloud so that documents can be opened and edited in the browser. An attacker needs no login and ends up running commands on the server. If you use the app and it is not on version 26.4.303 or later, deal with it today.

What happened

Nextcloud is self-hosted file storage and sharing. The Collabora Online Built-in CODE Server app, listed in the app catalogue as richdocumentscode, adds document editing in the browser. The app contains a script called proxy.php that forwards requests to the local document service and starts that service when it is not running. According to the advisory from Collabora, text taken from the request ended up in that start-up command, so an attacker could have an operating system command executed with the privileges of the web server account.

Collabora rates the flaw as critical with a CVSS 4.0 score of 9.2: network attack, no authentication, no user interaction, full impact on confidentiality, integrity and availability. The vendor advisory was published on 14 October 2026, CISA added the flaw to its exploited list on 23 October and gave US federal agencies until 26 October 2026 to fix it.

This is not theory. On 11 September 2026 an administrator described in a report on the richdocumentscode GitHub tracker how his servers received requests to /apps/richdocumentscode/proxy.php?status with commands encoded in the URL, how unknown PHP files were left behind in the app directory and how the server tried to reach the external service webhook.site. Nobody has published how many installations were compromised in total.

Does this affect you?

What to do now

  1. Update the app to version 26.4.303 or later. It installs from the Nextcloud app catalogue like any other update.
  2. If you do not use document editing in Nextcloud, remove the app. Collabora presents this as an equally valid fix and it removes one more service reachable from the internet.
  3. If you run Nextcloud 29 or older, which is out of support, Collabora recommends upgrading Nextcloud itself or removing the app.
  4. The vendor offers no temporary workaround and there is no setting that disables the flaw. If you cannot apply the update immediately, restrict access to the instance from the internet until you can.

How to tell whether you have been compromised

Neither Collabora nor CISA has published indicators. The administrator report on GitHub suggests what to look for in your logs:

If you confirm such a finding, an update alone is not enough. Treat the server as compromised: take it off the network, preserve the logs, review accounts and scheduled jobs, and restore from a backup taken before the first suspicious request. Our guidance for the first hours is on the page Dealing with an incident.

No time to track this?

Flaws like this appear in tools nobody considers security products, and they have to be fixed fast. We help organisations set out who watches vulnerabilities, how priorities are decided and how to measure that fixes really landed. A security assessment gives you the current picture, an external security manager runs the agenda long term. The initial consultation is free, get in touch through our contact page.

Sources: Collabora Online, advisory for CVE-2026-110447 · CISA, known exploited vulnerabilities catalogue · richdocumentscode, administrator report on compromised servers