CISA Adds Critical Nextcloud Collabora Online Flaw to Actively Exploited List
CISA lists CVE-2026-110447 in the richdocumentscode plugin for Nextcloud among actively exploited vulnerabilities. The fix is available in version 26.4.303.
The Nextcloud Collabora Online flaw identified as CVE-2026-110447 has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The October 23, 2026 entry confirms that the critical vulnerability is not merely theoretical but has been exploited in practice. It affects the richdocumentscode application, known as Collabora Online – Built-in CODE Server.
Application versions older than 26.4.303 are vulnerable. The fix is available in version 26.4.303. Administrators of publicly accessible Nextcloud servers should update or remove the application without delay and examine systems that were exposed before the fix was deployed.
What the Nextcloud Collabora Online flaw allows
CVE-2026-110447 is an OS command injection flaw. Under certain circumstances, an attacker can execute commands on the operating system with the privileges of the web server user. According to the CVE record, it is a critical vulnerability that can lead to remote code execution.
The attack does not require credentials or user interaction. However, it has an important condition: the built-in CODE server must not be running at the time of the attack. This can occur, for example, after a server restart, an application update, or a service crash.
This is not a general problem affecting all Collabora Online deployments. According to the security advisory, the flaw affects the built-in CODE server in the richdocumentscode application for Nextcloud. Separately operated Collabora Online servers are not affected.
An update is required; disabling it is not enough
Collabora says that simply disabling the vulnerable application is not sufficient mitigation. The correct procedure is to upgrade to richdocumentscode 26.4.303 or later, or remove the application from the server.
- Check the
richdocumentscodeapplication version on the Nextcloud instance. - If it is older than 26.4.303, update it to the fixed release.
- If you do not need the application, remove it; simply disabling it is not enough.
- Examine servers that were publicly accessible and used a vulnerable version before the fix was deployed.
Being added to the KEV catalog is particularly significant for administrators because CISA adds vulnerabilities with confirmed active exploitation. In the case of CVE-2026-110447, this means that the availability of a fix does not prevent attackers from attempting attacks against unupdated instances.
The scope of the attacks is not yet publicly known
No publicly verified number of compromised Nextcloud instances or organizations is currently available. Media have reported findings of web shells on attacked servers and possible ransomware cases, but the specific campaign and attribution of the attacks to particular actors have not been independently confirmed.
Further information may come from CISA, Collabora, or Nextcloud, particularly if they publish indicators of compromise or details about observed attacks. Any confirmation of the scope of affected servers and the actions of other security agencies will also be relevant.
Sources
- CISA Known Exploited Vulnerabilities Catalog – On October 23, 2026, CISA added CVE-2026-110447 among vulnerabilities with confirmed active exploitation.
- CollaboraOnline/online GitHub Security Advisory – Confirms the affected `richdocumentscode` application, versions before 26.4.303, the fix in version 26.4.303, the requirement that the CODE server not be running, and the ineffectiveness of simply disabling the application.
- CVE Record – Lists CVE-2026-110447 as a critical OS command injection flaw with RCE and reports exploitation in September and October 2026.
- BleepingComputer – Independently describes active attacks, the condition that the CODE server not be running, and administrator reports of web shells; it labels ransomware claims as unverified.
Verified and updated: October 24, 2026 06:19
