A critical, unauthenticated vulnerability in the Collabora Online integration for Nextcloud is being actively exploited to plant web shells on self-hosted servers, according to reports from BleepingComputer and The Hacker News published this week. The flaw, tracked as CVE-2026-110447, carries a CVSS score of 9.2 and lets attackers run operating-system commands on a vulnerable server without logging in at all. For an open-source platform that organizations choose specifically to keep sensitive files off third-party clouds, the irony is hard to miss: the very app meant to let teams edit documents together inside Nextcloud is the one that let intruders in.
The disclosure lands in the middle of what has already been an unusually brutal month for enterprise software vendors. BeyondTrust, FortiMail, Palo Alto Networks, Ivanti, Cisco, and SonicWall have all published critical advisories in recent weeks, and Microsoft’s October Patch Tuesday alone covered a record 1,413 CVEs. The Nextcloud-Collabora flaw adds a self-hosted collaboration platform to a list that increasingly reads like a roll call of the software every IT department depends on.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Is CVE-2026-110447, Exactly?
CVE-2026-110447 lives inside an optional Nextcloud app called Collabora Online – Built-in CODE Server, distributed under the package name richdocumentscode. Rather than pointing Nextcloud at an external Collabora Online server, this app bundles a lightweight Collabora Online Development Edition (CODE) instance directly inside the Nextcloud app ecosystem, so administrators can offer in-browser document editing without standing up separate infrastructure. That convenience is exactly what turned into a liability.
According to the vendor’s own advisory and subsequent reporting from SC World and protect.computer, the vulnerability sits in how the app’s proxy handling and startup mechanism construct operating-system commands. Because that construction does not require authentication, any remote attacker who can reach the Nextcloud instance can trigger the flaw and execute commands as the web-server user, no valid account or session needed. That is the combination security teams dread most: unauthenticated, remote, and capable of arbitrary command execution.
Who Is Affected: The Built-in CODE Server App
Scope matters enormously here, and Collabora has been specific about it. The vulnerability affects richdocumentscode versions 26.4.302 and earlier — that is, the optional built-in CODE app only. Reports citing the vendor’s advisory state that standalone Collabora Online servers, Docker-based Collabora deployments, RPM and DEB package installations, and Nextcloud All-in-One (AIO) setups are not affected by this particular flaw. If an organization runs Collabora as a separate service rather than through the bundled Nextcloud app, this specific CVE does not apply to that deployment.
That distinction will matter to administrators trying to triage quickly, but it does not shrink the exposure as much as it might sound. The built-in CODE app exists precisely because it is the easiest way to add collaborative document editing to a Nextcloud instance, which means it is a popular default for small and mid-sized organizations, schools, nonprofits, and self-hosting enthusiasts who chose Nextcloud specifically to avoid depending on a second server for office functionality.
Inside the Exploit: How Unauthenticated Command Injection Works
Command injection vulnerabilities are not new, but the unauthenticated angle is what pushes CVE-2026-110447 into critical territory. In a typical authenticated command-injection bug, an attacker needs valid credentials or a hijacked session before they can even attempt exploitation, which limits the blast radius to accounts that have already been compromised some other way. Here, reports describe the flaw as exploitable directly against the app’s proxy and startup logic, with no login step required.
Once an attacker can run arbitrary commands as the web-server user, the next moves are predictable: drop a persistent foothold, then look around. According to BleepingComputer’s reporting, that is exactly what happened. Attackers used the flaw to plant PHP web shells on compromised Nextcloud servers, giving themselves a durable backdoor that survives a simple restart and does not require re-exploiting the original bug every time they want access.
What Attackers Did Once Inside: Web Shells and Credential Hunting
A web shell is only the entry point. Per the same reporting, once attackers had shell access on compromised servers they moved on to searching the file system for password databases, password-manager export files, and cryptocurrency wallet artifacts. That targeting pattern is consistent with opportunistic, financially motivated intrusion rather than a narrow espionage campaign aimed at a specific sector — the attackers appear to be casting a wide net across however many vulnerable Nextcloud instances they can find, then rifling through whatever shows up.
No public reporting reviewed for this story names the threat actor or group behind the exploitation, nor does it put a confirmed number on how many servers were compromised before the patch became available. That lack of attribution and victim-count data is itself a reminder of how this story differs from, say, the BeyondTrust zero-day tied to the China-nexus group Armory Castle: this looks like commodity exploitation of a disclosed flaw rather than a tracked, named espionage operation.
From Patch to Panic: A Timeline of Disclosure and Exploitation
The timeline here is uncomfortably familiar to anyone who has tracked enterprise-software CVEs in 2026. Collabora shipped the fixed version, 26.4.303, on September 11, 2026. Public reporting on active exploitation followed roughly a month later, with cyberexperts.com describing servers as having been “quietly backdoored through an office app since September” and dailysecurityreview.com, protect.computer, and NeoTeo all publishing coverage between October 14 and October 17.
That gap between patch release and the moment organizations realize they need to act is where most real-world damage happens. It’s the same pattern security teams have watched play out with FortiMail’s CVSS 9.8 zero-day and the three-flaw Ivanti Connect Secure and Citrix NetScaler chain earlier this year: a fix exists, but adoption lags, and attackers treat that lag as their operating window.
Why Disabling the App Isn’t Enough
One detail in the vendor guidance deserves particular attention because it runs against a common assumption. Collabora’s advisory, as relayed by The Hacker News and SC World, states explicitly that simply disabling the richdocumentscode app inside Nextcloud does not remediate the vulnerability. Administrators must either update to version 26.4.303 or later, or fully remove the app from the server. A disabled app can, in some configurations, leave the underlying vulnerable code and its proxy logic reachable, which defeats the instinct many admins have to flip an app off and move on.
This is worth flagging because it is exactly the kind of remediation gap that shows up again and again in post-incident reviews. A team sees a critical advisory, disables the affected feature as a quick stopgap, confirms the app shows as “disabled” in the admin panel, and considers the issue closed. If Collabora’s warning is accurate, that stopgap alone would not have protected those servers.
The Fix: Updating to Collabora 26.4.303
For administrators running the affected app, the remediation path is straightforward even if the underlying bug was not. Nextcloud’s command-line tool, occ, is the standard way most self-hosted admins manage installed apps, and the update process looks the same as any other app patch:
# Check the installed version of the affected app
occ app:list | grep richdocumentscode
# Update to the patched release (26.4.303 or later)
occ app:update richdocumentscode
# If an immediate update isn't possible, remove the app entirely
occ app:remove richdocumentscodeGiven the vendor’s warning that disabling alone is insufficient, organizations that cannot update immediately should treat full removal as the safer interim step rather than toggling the app off through the web interface. Server logs should also be reviewed for unexpected PHP files, unfamiliar admin accounts, or scheduled tasks created after September 11, 2026, since that is the window during which a patch existed but exploitation had reportedly already begun according to cyberexperts.com’s account.
2026’s Pattern: Collaboration Software Under Sustained Siege
Zoom out, and the Nextcloud-Collabora flaw is not an isolated event so much as the latest entry in a year-long pattern. 2026 has seen a steady drumbeat of critical, often unauthenticated flaws in exactly the categories of software organizations rely on to collaborate and administer their own infrastructure remotely. The Palo Alto Networks PAN-OS flaw tracked as CVE-2026-0322 hit a CVSS score of 8.6 with root-level access implications. Cisco and SonicWall advisories reached a maximum CVSS of 10.0 earlier this year. And the Warlock ransomware campaign showed how a single bug in a widely deployed collaboration platform — in that case Microsoft SharePoint — can cascade into ransomware across multiple sectors within days of disclosure.
What ties these stories together is not a single attacker or a single vendor’s engineering failure. It is the structural reality that remote-access and collaboration platforms are, by design, exposed to the internet and trusted with sensitive data and elevated permissions. When a flaw surfaces in that category of software, the exploitation window tends to be short and the payoff for attackers tends to be high, which is exactly the combination that has defined the CVE landscape this year.
A Recurring Flaw in the Same Integration Layer
Adding to the sense of déjà vu, a report from NeoTeo notes that GitHub maintainers had to clarify that CVE-2026-110447 is a distinct vulnerability from a previously disclosed flaw in the same Collabora-Nextcloud integration, CVE-2025-66208. Two separate critical bugs surfacing in the same integration layer within roughly a year suggests the built-in CODE bridge between Nextcloud and Collabora may warrant closer, ongoing scrutiny rather than treating this disclosure as a one-off.
Competitive Comparison: Self-Hosted Collaboration Platforms and Attack Surface
Nextcloud’s appeal has always rested on control: organizations run their own file-sharing and document-collaboration stack instead of handing data to a third-party cloud provider. That same self-hosted model is also what makes patch discipline entirely the customer’s responsibility. A SaaS alternative pushes security fixes centrally and the vulnerability window closes for every customer at once. A self-hosted Nextcloud-plus-Collabora stack only closes that window when each individual administrator applies the update, which is precisely why a flaw patched on September 11 was still being actively exploited over a month later.
This is not a reason to abandon self-hosted collaboration tools, but it is a reminder that the trade-off runs in both directions. Teams that choose Nextcloud, or comparable self-hosted platforms, over commercial alternatives gain data sovereignty and independence from a vendor’s business decisions, but they also inherit the full weight of patch management, exposure monitoring, and incident response that a managed cloud service would otherwise absorb on their behalf.
Market Impact: What This Means for Nextcloud and Enterprise IT
The immediate market impact of a single CVE on an open-source platform is rarely measured in stock price, since Nextcloud GmbH is privately held, but the reputational and operational stakes are real. Nextcloud has spent years positioning itself to privacy-conscious enterprises, government agencies, and regulated industries in Europe specifically as the alternative to US-based cloud storage and collaboration suites. A critical, actively exploited, unauthenticated vulnerability in a bundled collaboration feature cuts directly against that pitch, and competitors selling managed alternatives will likely point to this disclosure as evidence that self-hosting shifts risk onto the customer.
For IT buyers more broadly, the episode reinforces a trend already visible in how organizations evaluate platforms like Microsoft Defender XDR, Sophos XDR, and other detection tooling: the question is shifting from “did we patch this specific CVE” to “how quickly can we detect and contain exploitation of a flaw we have not yet patched.” Attack surface management and exposure monitoring tools, rather than patch cadence alone, are increasingly the differentiator between organizations that get breached and those that catch an intrusion attempt before it becomes a backdoor.
CVE-2026-110447 Vulnerability Profile at a Glance
| Attribute | Detail |
|---|---|
| CVE identifier | CVE-2026-110447 |
| CVSS score | 9.2 (Critical) |
| Affected component | Collabora Online – Built-in CODE Server app (richdocumentscode) |
| Affected versions | 26.4.302 and earlier |
| Patched version | 26.4.303 (released September 11, 2026) |
| Vulnerability type | Unauthenticated OS command injection |
| Authentication required | None |
| Observed exploitation | PHP web shell deployment, credential and crypto-wallet file searches |
| Unaffected deployments | Standalone Collabora Online, Docker/RPM/DEB installs, Nextcloud AIO |
| Remediation | Update to 26.4.303+ or fully remove the app (disabling alone is insufficient) |
2026’s Critical Collaboration and Remote-Access CVEs Compared
| Product | CVE | CVSS | Category |
|---|---|---|---|
| Nextcloud / Collabora Online (Built-in CODE) | CVE-2026-110447 | 9.2 | Collaboration platform |
| BeyondTrust Remote Support | CVE-2026-102764 | 9.3 | Remote administration |
| FortiMail | CVE-2026-104286 | 9.8 | Email security appliance |
| Palo Alto Networks PAN-OS | CVE-2026-0322 | 8.6 | Network firewall OS |
| Cisco / SonicWall advisories | Multiple | Up to 10.0 | Network infrastructure |
| Microsoft October Patch Tuesday | 1,413 CVEs total | Varies | Operating system / enterprise software |
Taken together, these figures show a pattern rather than a coincidence: critical, high-CVSS flaws are landing across nearly every category of enterprise infrastructure software in the same several-month window, from firewalls and remote-support tools to email gateways and now self-hosted collaboration suites.
Historical Context: Open Collaboration Tools Have Been Targets Before
Collaboration and document-editing integrations have a long track record as attacker targets precisely because they are designed to accept and process files and requests from many users, including external ones. The underlying logic is simple: a feature built for flexibility — rendering documents, proxying requests to a rendering engine, handling uploads from unauthenticated share links — tends to carry a wider attack surface than a feature built for a narrow, authenticated purpose. Nextcloud’s own public bug-bounty and security-advisory history includes prior flaws in sharing and file-preview functionality, and the NeoTeo report’s reference to last year’s CVE-2025-66208 in the same Collabora bridge fits that longer pattern rather than breaking from it.
What Comes Next: Five Predictions
- Expect CISA or an equivalent national cybersecurity agency to add CVE-2026-110447 to a known-exploited-vulnerabilities catalog if active exploitation is independently confirmed, mirroring how CVE-2026-104286 and other 2026 flaws were handled.
- Collabora and Nextcloud will likely face pressure to publish a clearer, centralized advisory page specifically for the richdocumentscode app, given that current guidance is scattered across third-party security outlets rather than a single authoritative source.
- Security vendors will use this disclosure in marketing material aimed at Nextcloud’s self-hosting customer base, pitching exposure-monitoring and attack-surface-management add-ons as a hedge against slow in-house patch cycles.
- Expect follow-on reporting to eventually attach a victim count or named threat-actor group to the campaign, since initial disclosures of this kind are frequently updated in the following weeks as incident responders compare notes.
- Other self-hosted platforms that bundle third-party rendering or proxy components — not just Nextcloud — are likely to see renewed security research attention as researchers look for similar unauthenticated command-injection patterns in comparable integrations.
What IT Teams Should Do Right Now
Organizations running Nextcloud with the built-in CODE app enabled should treat this as an immediate-priority item rather than something to schedule for a routine maintenance window. The practical checklist is short: confirm whether richdocumentscode is installed at all, check the installed version against 26.4.303, update or remove the app accordingly, and then audit the server for signs of prior compromise rather than assuming a clean patch retroactively undoes any exploitation that already happened.
That audit step matters because, as with the credential-hunting behavior described in BleepingComputer’s reporting, an attacker who gained access before the patch was applied may have already planted a web shell that a version update alone will not remove. Reviewing for unfamiliar PHP files in web-accessible directories, unexpected admin accounts, and unusual outbound connections from the server is a reasonable baseline response for any organization that ran an affected version between September 11 and whenever they applied the fix.
Frequently Asked Questions
What is CVE-2026-110447?
It is a critical, unauthenticated operating-system command injection vulnerability in the Collabora Online – Built-in CODE Server app for Nextcloud, carrying a CVSS score of 9.2.
Is my Nextcloud instance affected?
Only if you use the optional built-in CODE app (package richdocumentscode) at version 26.4.302 or earlier. Standalone Collabora Online servers, Docker and RPM/DEB installations, and Nextcloud All-in-One deployments are reported as unaffected by this specific flaw.
Is disabling the app enough to protect my server?
No. Collabora’s advisory, as reported by The Hacker News and SC World, states that disabling the app alone does not remediate the vulnerability. You need to update to version 26.4.303 or later, or remove the app entirely.
When was this vulnerability fixed?
Collabora released the patched version, 26.4.303, on September 11, 2026. Public reports of active exploitation surfaced roughly a month later, between October 14 and October 17.
What have attackers been doing after exploiting the flaw?
According to BleepingComputer’s reporting, attackers planted PHP web shells on compromised servers and then searched for password databases, password-manager files, and cryptocurrency wallet data.
Who is behind the attacks?
No named threat actor or group has been publicly attributed to this campaign in the reporting reviewed for this story.
How many servers have been compromised?
No confirmed, specific victim count has been published. Reports describe active exploitation as ongoing since at least September, but a precise figure has not been verified.
Does this affect Nextcloud itself, or only the Collabora integration?
The flaw is specific to the Collabora Online Built-in CODE Server app that plugs into Nextcloud, not the core Nextcloud platform. Nextcloud installations that do not use this specific app are not affected by CVE-2026-110447.
