CISA confirms attacks on Nextcloud’s Collabora CODE app. The federal fix date is today

We flagged this Nextcloud bug on October 15, when administrators were finding web shells planted through Collabora’s Built-in CODE Server app. On Friday, October 23, CISA added it to the Known Exploited Vulnerabilities catalog and gave federal agencies until today, October 26, to fix it.

The deadline binds only federal civilian agencies. For everyone else it is a useful nudge: if a Nextcloud server skipped the mid-October update, the attacks it was exposed to are now confirmed by CISA as well as by the administrators who found the shells.

CISA gave agencies three days to fix the Nextcloud Collabora CODE flaw. The deadline is today, and turning the app off was never the fix.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

CISA put the Collabora CODE app flaw on its exploited list

CISA’s October 23 alert lists CVE-2026-110447, a Collabora Online Built-in CODE Server OS command injection, as exploited. The KEV catalog entry sets a due date of October 26 for federal civilian agencies. CISA lists ransomware use as unknown.

The GitHub advisory says the flaw was exploited in the wild in September and October 2026. It sits in the app’s proxy.php and works only while the bundled document server is stopped, such as right after a restart or an upgrade. BleepingComputer reported that some users said ransomware operators were exploiting it, which it could not confirm.

Nextcloud servers that still run richdocumentscode 26.4.302 or older

The app, package name richdocumentscode, is the optional bundled document server for Nextcloud Office, and its store listing pitches it at personal use and small teams. That is the kind of server that gets set up once and left alone. Standalone Collabora Online, Docker and package installs, and Nextcloud All-in-One are not affected, according to Collabora.

Patching to 26.4.303 closes the hole but leaves anything an attacker already planted. In the attacks The Hacker News reviewed, the web shell went into the app’s own folder and was used to search for password vaults and wallet files.

Confirm 26.4.303 or removal, then look for web shells

• Run sudo -u www-data php occ app:list | grep richdocumentscode on each Nextcloud server. You want 26.4.303 or later, or no result at all. Disabling the app does not count.
• Nextcloud 29 and older cannot take the fixed app; upgrade Nextcloud or remove the app.
• Search apps/richdocumentscode for PHP files you did not install and compare file dates with your update history.
• If a server ran 26.4.302 or older while reachable from the internet, rotate the database password and app passwords the web server account could read.

Details

• CVE-2026-110447: OS command injection in proxy.php, Collabora Online Built-in CODE Server (richdocumentscode) before 26.4.303, CVSS 9.2. Fixed September 11; advisory and CVE published October 14.
• KEV: added October 23, 2026 (catalog 2026.10.23), due October 26, 2026. Known ransomware use: unknown.
• Earliest reported attack: September 10, against servers on 26.4.302, according to The Hacker News.

Hunt / verify

• Search web server logs since September 10 for requests to proxy.php?status with shell syntax such as $( in the path.
• Run Nextcloud’s integrity check; one administrator found the shell when it flagged a new PHP file.
• Look for outbound requests from the web server to webhook services, which the attacker used to send back uname -a output.

Source: CISA KEV alert, October 23, 2026; GitHub advisory GHSA-f97p-r72q-64h2

Sources

• CISA: CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2026-110447)
• CISA: Known Exploited Vulnerabilities Catalog
• GitHub Advisory Database: CVE-2026-110447
• BleepingComputer: Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers
• The Hacker News: Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App
• CVE.org: CVE-2026-110447

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].