Collabora vulnerability in Nextcloud is being actively exploited

There is a critical vulnerability in the Collabora Online – Built-in CODE Server plugin used for document editing on Nextcloud servers, and it is currently being exploited in real attacks. The issue, assigned CVE-2026-110447, was added to CISA’s Known Exploited Vulnerabilities (KEV) list on October 23, 2026. The remediation deadline for US federal agencies is October 26, 2026.

Which installations are affected

The issue affects only the richdocumentscode package, i.e. the “Built-in CODE Server” plugin installed from the Nextcloud app store. All versions before 26.4.303 are affected; the fix is in version 26.4.303. It should not be confused with CVE-2025-66208, announced in 2025; Collabora also notes that the fix for that vulnerability does not address this issue.

Standalone Collabora Online servers, versions installed with Docker or via the distribution’s RPM/DEB package, and Nextcloud All-in-One installations are not affected. If you provide document editing through a separate Collabora server, this vulnerability does not affect you.

How the vulnerability works

The vulnerability is based on OS command injection (CWE-78) at the plugin’s proxy.php endpoint. The attacker does not need authentication or user interaction; a specially crafted request executes commands on the server with the privileges of the web server user. There is a critical condition: the internal CODE server must not be running at that moment. In this short window, which occurs after a restart, update, or crash, the request is handled by the process started by the plugin itself, and the injection takes effect. Collabora assigns the vulnerability a CVSS 4.0 score of 9.2, i.e. critical.

What’s being seen in the wild

According to reports shared by Nextcloud administrators, attacks began to be seen starting September 10. The fix landed in the codebase on September 9, and version 26.4.303 was released on September 11; however, the security advisory and CVE number were announced on October 14. During the more than four weeks in between, the vulnerability’s identity was unknown, making correlation harder for defenders.

Attackers have been reported to place PHP web shells on compromised servers, then search for password databases, password manager remnants, and crypto wallet files. Some administrators reported that ransomware operators also used the vulnerability; in CISA’s record, use in a ransomware campaign is marked as “unknown.” The vulnerability can be tested with automated tools: in CISA’s SSVC assessment, the “automatable” field is yes, and technical impact is total.

What to do

If you are a Nextcloud administrator, the first thing to do is check the plugin version. If it is below 26.4.303, update it from the app store. If you do not use the plugin, removing it is the cleanest solution. Disabling it alone is not enough: Collabora explicitly states that this step does not provide protection because the files remain in place. If you are using Nextcloud 29 or earlier, which are end-of-support, either upgrade Nextcloud or remove the plugin entirely.

Patching alone may not be enough. An attacker who caught a moment when the internal CODE server was down may have established a foothold before the update. Therefore, you need to scan the Nextcloud directory for newly added PHP files, web shell remnants, and unexpected scheduled tasks; if in doubt, change the Nextcloud and database passwords, active sessions, and API keys. If your server is reachable from the internet, do not postpone this check.

Source: CISA KEV · NVD