# Nextcloud CVE-2026-110447 Lets Attackers Plant Web Shells: Patch Now

- URL: https://usa-24.com/nextcloud-cve-2026-110447-web-shells/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-19T00:49:59.894Z
- Updated: 2026-10-19T00:49:59.903Z
- Topics: Nextcloud, Collabora, Web Shells, Vulnerability Management, Self-Hosted Software

> Attackers are exploiting a critical, unauthenticated flaw in Collabora's Built-in CODE app for Nextcloud to plant web shells on self-hosted servers. Disabling the app is not enough; update or remove it.

## Key takeaways

- CVE-2026-110447 is a critical, unauthenticated command-injection flaw rated 9.2 on CVSS v4.0 and classified as CWE-78.
- The bug sits in the optional Collabora Built-in CODE Server app, not core Nextcloud, and affects versions earlier than 26.4.303.
- The first logged attack came on September 10, 2026, one day before Collabora released the fix on September 11.
- Disabling the Collabora app is not enough, because one report says the vulnerable proxy script still runs when the app is turned off.
- Patching closes the entry point but does not prove an existing web shell is gone, so administrators should search for unexpected PHP files.

Attackers are breaking into self-hosted Nextcloud servers through a critical flaw in an optional app, then leaving behind web shells that let them run commands remotely. The campaign behind Nextcloud CVE-2026-110447 has been active since at least September 10, 2026, according to [The Hacker News](https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html), and coverage on October 16 and 17 shows exploitation was still being reported. Administrators should treat this as an urgent patch, not a routine update.

## Which Nextcloud servers are exposed to CVE-2026-110447

The flaw does not live in core Nextcloud. It sits in the Collabora Built-in CODE Server app, an optional add-on, and [SC World](https://www.scworld.com/brief/vulnerability-in-nextcloud-app-allowed-attackers-to-plant-web-shells) reports that attackers used it to deploy web shells. Nextcloud is widely used for file sharing and collaboration, especially among small businesses, which puts many affected administrators at small companies and IT teams. No source counts how many US organizations are running a vulnerable build.

The severity is high. [CyberSec Guru](https://thecybersecguru.com/exploits/nextcloud-cve-2026-110447-collabora-rce/) rates the flaw 9.2 on the CVSS v4.0 scale, which places it in the Critical band, and classifies it as CWE-78, OS command injection. [Tech-Insider](https://tech-insider.org/nextcloud-collabora-vulnerability-cve-2026-110447/) lists versions earlier than 26.4.303 as vulnerable, although one source says 26.4.302 and earlier. Treat any build below 26.4.303 as exposed until you confirm otherwise.

Standalone Collabora Online servers are not affected, according to [Cyber Security News](https://cybersecuritynews.com/hackers-exploit-critical-collabora-online-flaw/). Deployment scope is less settled. Tech-Insider lists Docker, RPM/DEB and Nextcloud AIO installs as unaffected, while other reports confirm only the standalone exemption. Check your setup against the official advisory rather than relying on a secondhand list.

## How the attack timeline unfolded

Three administrators reported the issue on GitHub, and the first logged attack happened on September 10. The table below lays out the key dates reported across the coverage.

| Date (2026) | What happened |
|---|---|
| September 10 | First logged attack, per administrator reports on GitHub |
| September 11 | Collabora releases the fix in version 26.4.303 |
| October 14 | Collabora publishes an advisory saying disabling the app is not enough |
| October 14 and 16 | The CISA alerts for these dates do not include CVE-2026-110447 |

The gap that matters most sits between the first two rows. The first logged attack came one day before the fix shipped, so some servers were compromised before any patch existed. Anyone who waited for the October 14 advisory to act did so more than a month after the fix was available. Reports describe activity across September and October 2026, and no source has established whether exploitation began before September 10.

## How the proxy.php flaw gets attackers in

The vulnerable endpoint is proxy.php. According to [IT-Connect](https://www.it-connect.tech/nextcloud-servers-hacked-through-critical-collabora-built-in-code-flaw/) and [CyberSec Guru](https://thecybersecguru.com/exploits/nextcloud-cve-2026-110447-collabora-rce/), the attack works only while the built-in CODE server is not running, such as during restarts, upgrades or crashes. That condition narrows the window, but restarts and upgrades are ordinary maintenance tasks, so it offers little protection.

Once inside, the attacker's commands did the rest. [InfoSec Today](https://www.infosectoday.io/hackers-backdoor-nextcloud-servers-through-critical-flaw-in-collaboras-built-in-code-app/) describes one administrator's logs showing commands that wrote a one-line PHP web shell and tried to send system information to an external webhook address. That combination points to both persistence and reconnaissance.

Web shells matter because they let an attacker keep access after the first break-in. They usually run with the permissions of the web server account, so anything that account can read becomes part of the risk, as [Cyber Security News](https://cybersecuritynews.com/hackers-exploit-critical-collabora-online-flaw/) explains.

## Why disabling the Collabora app is not enough

Collabora's October 14 advisory is direct: disabling the app is insufficient, and administrators must either update or completely remove it, according to [SC World](https://www.scworld.com/brief/vulnerability-in-nextcloud-app-allowed-attackers-to-plant-web-shells). IT-Connect adds a detail that makes the problem worse, reporting that the vulnerable proxy script can still run even when the app is disabled. An administrator who switched the app off and moved on may still have an open door.

The earlier Collabora bug will not help here. Collabora says the attack path differs from CVE-2025-66208, and installing that earlier fix does not block this exploit. Teams that patched the previous issue should not assume this one is also closed.

## What attackers wanted and what may have leaked

Reported attackers searched for credential stores and cryptocurrency wallets, according to SC World. The stakes extend beyond the server itself, since any credential stored on it or accessible from it could open other systems.

Whether data left the network is still unclear. One administrator saw no archive or upload commands in the logs reviewed, but the exposure scope is not established, per [InfoSec Today](https://www.infosectoday.io/hackers-backdoor-nextcloud-servers-through-critical-flaw-in-collaboras-built-in-code-app/). No source discloses how many servers were compromised, and none identifies a threat group behind the activity, according to [Cyber Security News](https://cybersecuritynews.com/hackers-exploit-critical-collabora-online-flaw/).

USA 24's earlier report on the [OpenCode console breach](https://usa-24.com/opencode-breach-api-keys-rotate/), which may expose OpenAI, Anthropic and Google API keys, shows why rotating keys belongs in any response to a possible compromise.

## How to tell if your Nextcloud server is hacked

Start with the steps that close the hole, then check for damage.

- Confirm whether the Collabora Built-in CODE Server app, identified as richdocumentscode, is installed on your server.
- Update to 26.4.303 or later, or fully remove the app. Disabling it alone is not enough.
- Look for unexpected PHP files, especially in the app and data folders, and review Nextcloud integrity-check alerts, as [Forgenex](https://www.forgenex.com/en/blog/nextcloud-fallo-en-app-collabora-permite-backdoors-en-servidores) recommends.
- If the server was exposed and unpatched, treat everything the web server account could read as potentially exposed, and rotate the credentials stored on or accessible from that server.
- Before concluding the server is clean, check for web shells. Patching closes the entry point but does not prove an existing shell is gone.

If you find a PHP file you did not create, assume an attacker has had a foothold. Bring in whoever handles incident response before you start deleting files, so you keep the evidence needed to see what was touched.

## What to watch next for the Nextcloud flaw

CISA is the first thing to watch. Its [October 14 alert](https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog) and [October 16 alert](https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog) did not add this CVE to the Known Exploited Vulnerabilities catalog. A KEV listing would put federal agencies on a formal remediation clock and give private administrators a clearer benchmark.

The other open questions are how many servers were compromised, whether exploitation began before September 10, and which installation types are truly out of scope. Fast exploitation of internet-facing products is a familiar pattern, as seen in the [Palo Alto PAN-OS zero-day CVE-2026-0322](https://usa-24.com/palo-alto-pan-os-zero-day-patch/) that USA 24 covered earlier.

Expect more detail from the official advisory and from administrators sharing their own log findings. If a threat group or a count of affected servers surfaces, the story will shift quickly. Until then, any Nextcloud host running the Collabora app needs a check this week, and that check should include a search for web shells, not just an update.

## Frequently asked questions

### How do I know if my Nextcloud server is affected by CVE-2026-110447?

Check whether the Collabora Built-in CODE Server app (richdocumentscode) is installed and whether its version is earlier than 26.4.303. One source says 26.4.302 and earlier, so any build below 26.4.303 should be treated as vulnerable. Standalone Collabora Online servers are not affected, but deployment reports vary, so confirm against the official advisory.

### Is disabling the Collabora app enough to stop the attack?

No. Collabora's advisory says disabling the app is insufficient and requires either an update to 26.4.303 or later, or complete removal. One report says the vulnerable proxy script still runs even when the app is disabled.

### How can I check whether attackers left a web shell on my server?

Look for unexpected PHP files, especially in the app and data folders, and review Nextcloud integrity-check alerts. Patching does not remove a shell that is already in place, so the search has to happen separately from the update. If you find a PHP file you did not create, involve incident response before deleting anything.

### Is CVE-2026-110447 on CISA's Known Exploited Vulnerabilities list?

Not as of the CISA alerts for October 14 and 16, 2026, which do not include it. Whether CISA adds it later is still unresolved. Administrators should not wait for a listing before patching, because the exploit has been reported in the wild since at least September 10.

## Sources

1. [Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora's Built-in CODE App](https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html)
2. [Vulnerability in Nextcloud app allowed attackers to plant web shells](https://www.scworld.com/brief/vulnerability-in-nextcloud-app-allowed-attackers-to-plant-web-shells)
3. [Hackers Exploit Critical Collabora Online Flaw to Backdoor Nextcloud Servers](https://cybersecuritynews.com/hackers-exploit-critical-collabora-online-flaw/)
4. [Nextcloud Servers Hacked Through Critical Collabora Built-in CODE Flaw](https://www.it-connect.tech/nextcloud-servers-hacked-through-critical-collabora-built-in-code-flaw/)
5. [CVE-2026-110447: Critical Nextcloud RCE Flaw](https://thecybersecguru.com/exploits/nextcloud-cve-2026-110447-collabora-rce/)
6. [Nextcloud Vulnerability CVE-2026-110447: CVSS 9.2](https://tech-insider.org/nextcloud-collabora-vulnerability-cve-2026-110447/)
7. [Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora's Built-in CODE App](https://www.infosectoday.io/hackers-backdoor-nextcloud-servers-through-critical-flaw-in-collaboras-built-in-code-app/)
8. [Nextcloud: flaw in Collabora app allows backdoors on servers](https://www.forgenex.com/en/blog/nextcloud-fallo-en-app-collabora-permite-backdoors-en-servidores)
9. [CISA Adds Four Known Exploited Vulnerabilities to Catalog (Oct. 14, 2026)](https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog)
10. [CISA Adds Two Known Exploited Vulnerabilities to Catalog (Oct. 16, 2026)](https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog)