Nextcloud Built-in CODE Server (Collabora) CVE-2026-110447: exploited since September, now in CISA KEV

What changed

• 11 September 2026: Collabora released richdocumentscode 26.4.303, which fixed the flaw. According to The Hacker News, the release notes named only the bundled CODE build and carried no security notice.
• 3 October 2026: a warning on the Nextcloud community forum told users to update because the flaw was already being exploited and no CVE had been published.
• 14 October 2026: Collabora published advisory GHSA-g3vx-3m76-fghh, and CVE-2026-110447 was assigned (CVSS 4.0: 9.2, Critical).
• 14 and 15 October 2026: The Hacker News and BleepingComputer reported exploitation based on administrator reports going back to 10 September.
• 23 October 2026: CISA added CVE-2026-110447 to the KEV catalogue (catalogue version 2026.10.23), with a remediation due date of 26 October 2026. The entry marks forensic triage as required and lists ransomware campaign use as unknown.

Who is affected

• Nextcloud servers that have the Collabora Online – Built-in CODE Server app (richdocumentscode) installed at a version before 26.4.303.
• Nextcloud 29 and older are end of life and cannot install 26.4.303. Collabora’s advisory says to upgrade Nextcloud or remove the app.
• Not affected: standalone Collabora Online servers, according to the advisory. BleepingComputer, citing Collabora, adds Docker and RPM/DEB installations of Collabora Online and Nextcloud All-in-One deployments.

According to the advisory, the flaw only works while the built-in CODE server is not running, for example after a container restart, an upgrade or a crash. It does not require authentication or user interaction, and commands run as the web server account. Turning the app off in Nextcloud does not close the flaw: it must be upgraded to 26.4.303 or later, or removed.

Exploitation evidence

• Three Nextcloud administrators reported compromises on the project’s GitHub. The earliest logged attack was on 10 September 2026, against version 26.4.302.
• According to their reports, the attacker planted a small PHP web shell in the app directory (file names starting shx, among others) and used it to search for password manager vaults, credential stores and cryptocurrency wallets. None of the reports showed the attacker gaining root access.
• Reports differ on data theft. Security Affairs says configuration files containing credentials and application secrets were stolen, while The Hacker News says the reviewed requests showed no commands that archived, uploaded or copied files out. Either way, treat anything the web server account can read, including Nextcloud’s config.php, as potentially exposed.
• Some users said ransomware operators were exploiting the flaw. BleepingComputer could not confirm this, and we do not treat it as established.
• CISA’s KEV listing confirms active exploitation. The reports we reviewed name no threat actor, and the number of affected servers is unknown.

Mitigation and hardening

1. Update or remove. Update richdocumentscode to 26.4.303 or later, or uninstall it if you do not need it. Disabling it is not sufficient. The Hacker News reports that some administrators had start-up problems with the later 26.4.402 release and went back to 26.4.303, the version the advisory names as the fix.
2. Consider a standalone Collabora deployment. If document editing matters to the business, a separately hosted Collabora Online server is not affected by this flaw, according to the advisory. The app’s store listing describes the built-in server as “for local testing and non-production use”, as quoted by The Hacker News. This is our recommendation, not a step in the advisory.
3. Keep Nextcloud on a supported release. Releases up to Nextcloud 29 cannot install the fixed app.
4. Rotate secrets if compromise is suspected. That covers database credentials, config.php secrets, mail and storage credentials, and any API tokens the web server account could read.

Detection (high level)

• Integrity check: run Nextcloud’s code integrity check and look for unexpected PHP files, especially shx*.php, starting in apps/richdocumentscode. Names can vary, so investigate any file the check flags as extra.
• Access logs: review web logs back to at least 10 September 2026 for requests to the richdocumentscode proxy.php endpoint with unusual encoded characters, shell-style syntax or encoded blobs in the path. Requests from unfamiliar sources and outbound callbacks to public webhook services are worth investigating.
• Host signals: failed sudo attempts by the web server account, unexpected child processes of the web server, and CODE (coolwsd) processes with unusual start-up options.
• If you find evidence: preserve logs and file timestamps before cleaning up, remove the web shells, rotate exposed secrets, and treat the host as compromised until it has been reviewed. If you are unsure, rebuild it.

How PoCForge can help

If you run self-hosted Nextcloud and want an independent check of which apps and endpoints are exposed, and what the web server account can reach if one of them is abused, get in touch.

Sources

• Collabora advisory GHSA-g3vx-3m76-fghh (14 Oct 2026)
• Nextcloud community notice, “To Collabora built-in user: update ASAP” (3 Oct 2026)
• CISA, “CISA Adds One Known Exploited Vulnerability to Catalog” (23 Oct 2026)
• CISA Known Exploited Vulnerabilities catalogue (version 2026.10.23)
• BleepingComputer, “Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers” (15 Oct 2026)
• The Hacker News, “Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App” (14 Oct 2026)
• The Hacker News, “CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud” (24 Oct 2026)
• Security Affairs, “U.S. CISA adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog” (24 Oct 2026)

PoCForge publishes offensive-security research to explain attack paths and defensive controls. This article summarises public advisories and reporting only; it is not an exploit guide and does not describe a named client engagement.