Collabora CODE Server Flaw Exploited In Nextcloud (CVE-2026-110447)

At a glance

Severity	CRITICAL
CVSS	CVE-2026-110447: 9.2
EPSS (30-day exploit probability)	CVE-2026-110447: 1.2%
In CISA KEV (exploited)	Yes, due 2026-10-26
Vendor	Collabora
CVE IDs	CVE-2026-110447

CISA has added CVE-2026-110447, an OS command injection flaw in the Collabora Online Built-in CODE Server used inside Nextcloud, to its Known Exploited Vulnerabilities catalog on 23 October 2026. The bug allows remote code execution, has a CVSS 4.0 score of 9.2, and is exploited in the wild. The KEV due date is 26 October 2026, only three days after the listing.

What happened

According to the NVD entry, Collabora Online Built-in CODE Server before 26.4.303 (the richdocumentscode app for Nextcloud) allows remote code execution. NVD states it was exploited in the wild in September and October 2026. The flaw is an OS command injection in proxy.php that can be reached when the CODE server is not running, for example after the product was recently restarted.

NVD notes this is a different vulnerability from CVE-2025-66208. NVD published the record on 14 October 2026, and CISA added it to KEV nine days later.

Am I affected?

You are affected if you run Nextcloud with the built-in Collabora CODE Server (the richdocumentscode app) at a version before 26.4.303.

Affected: the Built-in CODE Server deployment inside Nextcloud, before 26.4.303.
Not affected, per NVD: standalone Collabora Online servers. The flaw is not present there.
Full affected version list: not disclosed in the structured NVD data. Check the project’s issue tracker linked below.

Technical details

Weakness: CWE-78, OS command injection.
Attack vector: network, no privileges and no user interaction required. The CVSS vector lists attack requirements as present (AT:P), which fits the condition that the CODE server must not be running.
Severity: CVSS 4.0 base score 9.2, critical.
KEV: added 2026-10-23, due 2026-10-26.
EPSS: 0.01225, about 1.2%. This is low, but EPSS is a prediction and confirmed exploitation in KEV outranks it.
Ransomware use: listed as unknown by CISA.

Why this matters

Analysis, not new facts. Document servers sit close to user files and often face the internet so that people can edit documents from anywhere. Unauthenticated command execution on such a host gives an attacker a foothold next to sensitive data. The restart condition matters in practice: routine maintenance or a crash can open the window, so a system that looked fine yesterday may be exposed today. Because exploitation is confirmed and the KEV deadline is three days out, treat this as a patch-within-hours item for any internet-facing instance.

How to detect exploitation

No indicators of compromise are published in the available sources, so the ideas below are hunting suggestions that follow from the facts, not known signatures.

Review web server logs for unusual requests to proxy.php under the richdocumentscode app, especially around restarts of the CODE server.
Look for unexpected child processes spawned by the web server or PHP user, such as shells or download tools.
Check for new files, scheduled jobs or user accounts created since September 2026, the earliest period NVD gives for exploitation.
CISA’s required action references its “Forensics Triage Requirements”, so preserve logs and disk evidence before you rebuild anything.

What to do

Update the Collabora Built-in CODE Server (richdocumentscode) app in Nextcloud to version 26.4.303 or later. A Nextcloud community thread linked by NVD urges users of the built-in server to update as soon as possible.
Follow CISA’s required action: apply mitigations in line with vendor instructions and BOD 26-04, and stop using the product if mitigations are not available.
Work out which of your assets are internet-exposed, as CISA tells stakeholders to evaluate each asset’s exposure.
Hunt for signs of compromise using the checks above, back to September 2026, and treat any hit as a full incident.
If you run standalone Collabora Online, no action is needed for this CVE according to NVD, but confirm which deployment you really have.

Related coverage

Sources

Spotted an error or outdated detail? Email contact@cyberstrikenews.com with the article link. We correct and note every change. Read our Editorial Policy.