Attackers are exploiting a critical flaw in Collabora's integration for Nextcloud and using it to plant PHP web shells on self-hosted file-sharing servers. The Nextcloud Collabora vulnerability, tracked as CVE-2026-110447, carries a CVSS v4 base score of 9.2 and allows unauthenticated operating system command injection. A secondary report from WindowsForum says CISA has added the flaw to its Known Exploited Vulnerabilities catalog with an October 26, 2026 due date. USA 24 could not confirm that listing on CISA's own site, so treat the date as provisional until it appears there.
The bug is not in Nextcloud's core code. It sits in an optional app, the built-in CODE Server that Collabora supplies for in-browser document editing, which installs as the richdocumentscode app. The Hacker News reported the backdoor campaign on October 14, the same day Collabora published its advisory and CVE. That split decides who is exposed and what a real fix looks like.
Which Nextcloud servers are affected
You are exposed if your server runs the built-in CODE Server and that app is older than 26.4.303. Every earlier version is affected. Collabora shipped the fix in 26.4.303 on September 11, 2026, according to SC World and The CyberSec Guru.
According to Cypeira and ServNet UK, these deployments are not affected:
- Standalone Collabora Online
- Docker, RPM and DEB packages
- Nextcloud All-in-One installs
The trigger is narrower than the headline suggests, but it is common in practice. The flaw can be reached while the built-in CODE server is not running, such as during restarts, upgrades or crashes. Attackers planted web shells during exactly those windows, so a server that looked healthy day to day may still have been hit, according to eSecurityPlanet.
Nextcloud is widely used by small and mid-sized businesses, according to Forgenex, which is why the exposure reaches far beyond security teams. The likely victims include small businesses, schools, nonprofits and individuals who run their own instances. Many of them do not have a dedicated security team to watch vendor advisories.
One source says the fix requires Nextcloud 30 or later. USA 24 could not confirm that requirement, so check your release notes before you update.
What attackers did on compromised servers
The attackers dropped PHP web shells, which give an intruder a remote command channel through the web server. On at least one server, they searched for password-manager files and cryptocurrency wallets, according to SC World and DIESEC. No root access was reported. That limits the damage, but a web server account can still read application files, configuration and any secrets stored there.
Three administrators reported the problem on GitHub after the first logged attack on September 10, according to The Hacker News. The sources do not give a count of compromised servers. One report says some users claim ransomware operators are involved, but that claim is unverified.
Nextcloud Collabora vulnerability timeline from fix to KEV listing
The sources agree on most dates but not all. The table lists the dates the reports support, with the conflicts marked.
| Date | Event |
|---|---|
| August 20 or September 9, 2026 | Fix committed, according to conflicting reports |
| September 10, 2026 | First logged exploitation |
| September 11, 2026 | Collabora ships fix in version 26.4.303 |
| October 3, 2026 | One report says the flaw was flagged as already exploited |
| October 14, 2026 | Collabora publishes advisory and CVE |
| October 23, 2026 | Reported KEV listing date, secondary source only |
| October 26, 2026 | Reported KEV due date, secondary source only |
One report says the fix was committed on August 20 as routine cleanup. Another says the commit landed on September 9. USA 24 could not resolve that conflict, and it matters. If the September 11 release date holds, administrators had a fix available for more than four weeks before the public advisory on October 14.
Why the CISA listing matters for self-hosted servers
The KEV catalog turns a vendor advisory into a federal patch deadline. CISA's October 20 alert describes BOD 26-04, which directs federal civilian agencies to prioritize KEV items on publicly exposed assets. The directive binds federal agencies, not private server owners. A KEV entry still signals that exploitation is happening, which makes it a useful tiebreaker when you decide what to patch first.
The same CISA alert shows the agency moving quickly on self-hosted and edge software. On October 20, CISA added six entries in one update, four of them for Plex Media Server. That batch is separate from the Nextcloud listing. Products that sit on public networks often run without a dedicated patch team, which makes them attractive targets. Attackers have been hitting similar systems recently, including Citrix NetScaler web shells on US VPN gateways and PHP2Shell attacks that started before patches arrived.
How to check whether your Nextcloud server was hacked
Work through these checks in order. No single check proves a server is clean.
- Confirm whether the richdocumentscode app is installed, and note the version that runs.
- Search web-accessible directories for unfamiliar PHP files, especially names beginning with shx.
- Review web server access logs for proxy.php?status requests you do not recognize.
- If the server was exposed during an outage, upgrade or restart after September 10, assume that files and credentials readable by the web server account may be exposed.
Web shells can be hidden or renamed, so a clean search is not a guarantee. If you find a suspicious file, treat the server as compromised and rebuild it from a known-good backup where possible.
How to patch the Collabora CODE app safely
Update richdocumentscode to version 26.4.303 or later. If you do not need the built-in CODE Server, remove the app instead. The vendor says disabling it is not enough, according to SC World and eSecurityPlanet, so a toggle is not a fix.
After patching, confirm that the new version is running. Then rotate passwords and keys if your server was exposed during the window described above. A patch closes the hole, but it does not remove a shell an attacker already planted, so the checks above still matter.
What to watch next
Three things bear watching. First, whether CISA publishes its own alert for CVE-2026-110447 and confirms the October 26 due date. Second, whether the fix-date conflict gets resolved, since that sets how long unpatched servers were exposed. Third, whether a ransomware follow-on appears, which remains unverified. Any server still running an affected version should not wait for a federal deadline before acting.
