CISA: Collabora Flaw in Nextcloud Is Being Actively Exploited (CVE-2026-110447)

On October 23, CISA added CVE-2026-110447 to its catalog of vulnerabilities exploited in real-world attacks. The flaw affects the Collabora Online — Built-in CODE Server app that runs inside Nextcloud. Under certain conditions, it can be used to execute system commands. A fix is available in version 26.4.303.

What’s newly confirmed

The vulnerability was disclosed earlier, on October 14. What’s new in the past 24 hours is the CISA catalog entry, which confirms the flaw is being exploited in practice. The agency has given U.S. federal agencies subject to its requirements until October 26 to act. That deadline isn’t legally binding on Polish organizations, but it’s a clear signal to review your deployments without delay.

According to the vendor, the vulnerable component is the proxy.php file in the richdocumentscode app. An attacker can run commands with the privileges of the web server user while the built-in CODE server isn’t running. That can happen during a container restart, an update, or after a crash.

Who is affected

App releases earlier than 26.4.303 are vulnerable. Standalone Collabora Online servers aren’t affected. The vendor also notes that the fix for the earlier CVE-2025-66208 doesn’t protect against this attack path.

One key detail: disabling the app isn’t enough to eliminate the risk. The recommended course is to update or remove it. Organizations running unsupported releases, Nextcloud 29 and earlier, should upgrade the platform or remove the app.

What to do now

• Check whether richdocumentscode is present, and which version, across all of your Nextcloud instances.
• Update the app to 26.4.303 or later. If that isn’t possible, remove it as the vendor recommends.
• Review access logs and web server process activity, especially around crashes and restarts.
• Investigate suspicious commands, new files and unusual outbound connections. Updating doesn’t tell you whether a compromise already took place.

SecurHUB’s take

Conditions that arise during restarts should also be factored into an application’s security assessment. Incident response can help determine the scope of suspicious activity and coordinate next steps if you find signs that the vulnerability was exploited.

Sources: CISA — KEV catalog, Collabora — security advisory, Breach Briefing