# Nextcloud Collabora Flaw Under Attack: Patch CVE-2026-110447 Now

- URL: https://usa-24.com/nextcloud-collabora-vulnerability-patch/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-24T00:50:08.350Z
- Updated: 2026-10-24T00:50:08.355Z
- Topics: Nextcloud, Collabora, Web Shells, Vulnerability Patching, Self-Hosted Software, CISA

> Attackers are planting PHP web shells through the built-in CODE app in Nextcloud. Update to 26.4.303 or remove the app, and check your server for signs of compromise.

## Key takeaways

- CVE-2026-110447 is a critical flaw in the built-in CODE Server of Nextcloud's Collabora integration, with a CVSS v4 base score of 9.2.
- Every version before 26.4.303 is affected, and Collabora shipped the fixed release on September 11, 2026.
- The first logged exploitation came on September 10, 2026, and attackers planted PHP web shells, sometimes while the CODE server was down.
- The vendor says disabling the app is not enough, so administrators must update to 26.4.303 or later or remove the app.
- A secondary report says CISA added the flaw to its KEV catalog with an October 26, 2026 due date, which USA 24 could not confirm on CISA's site.

Attackers are exploiting a critical flaw in Collabora's integration for Nextcloud and using it to plant PHP web shells on self-hosted file-sharing servers. The Nextcloud Collabora vulnerability, tracked as CVE-2026-110447, carries a CVSS v4 base score of 9.2 and allows unauthenticated operating system command injection. A [secondary report from WindowsForum](https://windowsforum.com/news/cisa-kev-flags-cve-2026-110447-patch-nextcloud-built-in-collabora-code-command-injection.449798/) says CISA has added the flaw to its Known Exploited Vulnerabilities catalog with an October 26, 2026 due date. USA 24 could not confirm that listing on CISA's own site, so treat the date as provisional until it appears there.

The bug is not in Nextcloud's core code. It sits in an optional app, the built-in CODE Server that Collabora supplies for in-browser document editing, which installs as the richdocumentscode app. [The Hacker News](https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html) reported the backdoor campaign on October 14, the same day Collabora published its advisory and CVE. That split decides who is exposed and what a real fix looks like.

## Which Nextcloud servers are affected

You are exposed if your server runs the built-in CODE Server and that app is older than 26.4.303. Every earlier version is affected. Collabora shipped the fix in 26.4.303 on September 11, 2026, according to [SC World](https://www.scworld.com/brief/vulnerability-in-nextcloud-app-allowed-attackers-to-plant-web-shells) and [The CyberSec Guru](https://thecybersecguru.com/exploits/nextcloud-cve-2026-110447-collabora-rce/).

According to [Cypeira](https://www.cypeira.com/blog/a-nextcloud-code-server-flaw-is-giving-attackers-web-shells) and [ServNet UK](https://www.servnetuk.com/news/collabora-rce-cve-2026-110447-nextcloud-backdoor), these deployments are not affected:

- Standalone Collabora Online
- Docker, RPM and DEB packages
- Nextcloud All-in-One installs

The trigger is narrower than the headline suggests, but it is common in practice. The flaw can be reached while the built-in CODE server is not running, such as during restarts, upgrades or crashes. Attackers planted web shells during exactly those windows, so a server that looked healthy day to day may still have been hit, according to [eSecurityPlanet](https://www.esecurityplanet.com/threats/news-collabora-nextcloud-cve-2026-110447/).

Nextcloud is widely used by small and mid-sized businesses, according to [Forgenex](https://www.forgenex.com/en/blog/nextcloud-fallo-en-app-collabora-permite-backdoors-en-servidores), which is why the exposure reaches far beyond security teams. The likely victims include small businesses, schools, nonprofits and individuals who run their own instances. Many of them do not have a dedicated security team to watch vendor advisories.

One source says the fix requires Nextcloud 30 or later. USA 24 could not confirm that requirement, so check your release notes before you update.

## What attackers did on compromised servers

The attackers dropped PHP web shells, which give an intruder a remote command channel through the web server. On at least one server, they searched for password-manager files and cryptocurrency wallets, according to [SC World](https://www.scworld.com/brief/vulnerability-in-nextcloud-app-allowed-attackers-to-plant-web-shells) and [DIESEC](https://diesec.com/2026/10/nextcloud-collabora-vulnerability-cve-2026-110447/). No root access was reported. That limits the damage, but a web server account can still read application files, configuration and any secrets stored there.

Three administrators reported the problem on GitHub after the first logged attack on September 10, according to [The Hacker News](https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html). The sources do not give a count of compromised servers. One report says some users claim ransomware operators are involved, but that claim is unverified.

## Nextcloud Collabora vulnerability timeline from fix to KEV listing

The sources agree on most dates but not all. The table lists the dates the reports support, with the conflicts marked.

| Date | Event |
|---|---|
| August 20 or September 9, 2026 | Fix committed, according to conflicting reports |
| September 10, 2026 | First logged exploitation |
| September 11, 2026 | Collabora ships fix in version 26.4.303 |
| October 3, 2026 | One report says the flaw was flagged as already exploited |
| October 14, 2026 | Collabora publishes advisory and CVE |
| October 23, 2026 | Reported KEV listing date, secondary source only |
| October 26, 2026 | Reported KEV due date, secondary source only |

One report says the fix was committed on August 20 as routine cleanup. Another says the commit landed on September 9. USA 24 could not resolve that conflict, and it matters. If the September 11 release date holds, administrators had a fix available for more than four weeks before the public advisory on October 14.

## Why the CISA listing matters for self-hosted servers

The KEV catalog turns a vendor advisory into a federal patch deadline. [CISA's October 20 alert](https://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog) describes BOD 26-04, which directs federal civilian agencies to prioritize KEV items on publicly exposed assets. The directive binds federal agencies, not private server owners. A KEV entry still signals that exploitation is happening, which makes it a useful tiebreaker when you decide what to patch first.

The same CISA alert shows the agency moving quickly on self-hosted and edge software. On October 20, CISA added six entries in one update, four of them for Plex Media Server. That batch is separate from the Nextcloud listing. Products that sit on public networks often run without a dedicated patch team, which makes them attractive targets. Attackers have been hitting similar systems recently, including [Citrix NetScaler web shells on US VPN gateways](https://usa-24.com/cve-2026-88771-netscaler-zero-day-exploit/) and [PHP2Shell attacks that started before patches arrived](https://usa-24.com/php2shell-exploitation-patch-guide/).

## How to check whether your Nextcloud server was hacked

Work through these checks in order. No single check proves a server is clean.

1. Confirm whether the richdocumentscode app is installed, and note the version that runs.
2. Search web-accessible directories for unfamiliar PHP files, especially names beginning with shx.
3. Review web server access logs for proxy.php?status requests you do not recognize.
4. If the server was exposed during an outage, upgrade or restart after September 10, assume that files and credentials readable by the web server account may be exposed.

Web shells can be hidden or renamed, so a clean search is not a guarantee. If you find a suspicious file, treat the server as compromised and rebuild it from a known-good backup where possible.

## How to patch the Collabora CODE app safely

Update richdocumentscode to version 26.4.303 or later. If you do not need the built-in CODE Server, remove the app instead. The vendor says disabling it is not enough, according to [SC World](https://www.scworld.com/brief/vulnerability-in-nextcloud-app-allowed-attackers-to-plant-web-shells) and [eSecurityPlanet](https://www.esecurityplanet.com/threats/news-collabora-nextcloud-cve-2026-110447/), so a toggle is not a fix.

After patching, confirm that the new version is running. Then rotate passwords and keys if your server was exposed during the window described above. A patch closes the hole, but it does not remove a shell an attacker already planted, so the checks above still matter.

## What to watch next

Three things bear watching. First, whether CISA publishes its own alert for CVE-2026-110447 and confirms the October 26 due date. Second, whether the fix-date conflict gets resolved, since that sets how long unpatched servers were exposed. Third, whether a ransomware follow-on appears, which remains unverified. Any server still running an affected version should not wait for a federal deadline before acting.

## Frequently asked questions

### Does CVE-2026-110447 affect every Nextcloud installation?

No. The flaw is in the built-in CODE Server app, which Collabora provides for in-browser document editing. Sources reviewed say standalone Collabora Online, Docker, RPM and DEB packages, and Nextcloud All-in-One installs are not affected. Check whether the richdocumentscode app is installed and which version runs.

### How do I know if my Nextcloud server was hacked?

Look for unfamiliar PHP files, especially names beginning with shx, and for proxy.php?status requests in your web server logs. A clean result is not proof, because web shells can be hidden or renamed. If your server was exposed during an outage or restart after September 10, rotate passwords and keys.

### Is disabling the Collabora app enough to protect my server?

No. According to SC World and eSecurityPlanet, the vendor says the app must be updated or removed. Update to version 26.4.303 or later if you need the app, or remove it if you do not.

### What is the CISA KEV due date for this Nextcloud flaw?

A secondary report lists October 26, 2026 as the KEV due date, which creates a federal patch deadline. USA 24 could not confirm that date on CISA's own site. Check the KEV catalog directly before relying on it.

## Sources

1. [CISA KEV Flags CVE-2026-110447: Patch Nextcloud Built-in Collabora CODE Command Injection (WindowsForum)](https://windowsforum.com/news/cisa-kev-flags-cve-2026-110447-patch-nextcloud-built-in-collabora-code-command-injection.449798/)
2. [Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora's Built-in CODE App (The Hacker News)](https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html)
3. [Vulnerability in Nextcloud app allowed attackers to plant web shells (SC World)](https://www.scworld.com/brief/vulnerability-in-nextcloud-app-allowed-attackers-to-plant-web-shells)
4. [Nextcloud Collabora Vulnerability Exploited (DIESEC)](https://diesec.com/2026/10/nextcloud-collabora-vulnerability-cve-2026-110447/)
5. [CVE-2026-110447: Critical Nextcloud RCE Flaw (The CyberSec Guru)](https://thecybersecguru.com/exploits/nextcloud-cve-2026-110447-collabora-rce/)
6. [A Nextcloud CODE server flaw is giving attackers web shells (Cypeira)](https://www.cypeira.com/blog/a-nextcloud-code-server-flaw-is-giving-attackers-web-shells)
7. [Critical Collabora Flaw Compromises Nextcloud Servers (eSecurityPlanet)](https://www.esecurityplanet.com/threats/news-collabora-nextcloud-cve-2026-110447/)
8. [Collabora RCE CVE-2026-110447: Nextcloud Under Attack (ServNet UK)](https://www.servnetuk.com/news/collabora-rce-cve-2026-110447-nextcloud-backdoor)
9. [CISA Adds Six Known Exploited Vulnerabilities to Catalog (CISA, Oct 20, 2026)](https://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog)
10. [Forgenex blog on Nextcloud Collabora web shells (Forgenex)](https://www.forgenex.com/en/blog/nextcloud-fallo-en-app-collabora-permite-backdoors-en-servidores)