Attackers are breaking into self-hosted Nextcloud servers through a critical flaw in an optional app, then leaving behind web shells that let them run commands remotely. The campaign behind Nextcloud CVE-2026-110447 has been active since at least September 10, 2026, according to The Hacker News, and coverage on October 16 and 17 shows exploitation was still being reported. Administrators should treat this as an urgent patch, not a routine update.
Which Nextcloud servers are exposed to CVE-2026-110447
The flaw does not live in core Nextcloud. It sits in the Collabora Built-in CODE Server app, an optional add-on, and SC World reports that attackers used it to deploy web shells. Nextcloud is widely used for file sharing and collaboration, especially among small businesses, which puts many affected administrators at small companies and IT teams. No source counts how many US organizations are running a vulnerable build.
The severity is high. CyberSec Guru rates the flaw 9.2 on the CVSS v4.0 scale, which places it in the Critical band, and classifies it as CWE-78, OS command injection. Tech-Insider lists versions earlier than 26.4.303 as vulnerable, although one source says 26.4.302 and earlier. Treat any build below 26.4.303 as exposed until you confirm otherwise.
Standalone Collabora Online servers are not affected, according to Cyber Security News. Deployment scope is less settled. Tech-Insider lists Docker, RPM/DEB and Nextcloud AIO installs as unaffected, while other reports confirm only the standalone exemption. Check your setup against the official advisory rather than relying on a secondhand list.
How the attack timeline unfolded
Three administrators reported the issue on GitHub, and the first logged attack happened on September 10. The table below lays out the key dates reported across the coverage.
| Date (2026) | What happened |
|---|---|
| September 10 | First logged attack, per administrator reports on GitHub |
| September 11 | Collabora releases the fix in version 26.4.303 |
| October 14 | Collabora publishes an advisory saying disabling the app is not enough |
| October 14 and 16 | The CISA alerts for these dates do not include CVE-2026-110447 |
The gap that matters most sits between the first two rows. The first logged attack came one day before the fix shipped, so some servers were compromised before any patch existed. Anyone who waited for the October 14 advisory to act did so more than a month after the fix was available. Reports describe activity across September and October 2026, and no source has established whether exploitation began before September 10.
How the proxy.php flaw gets attackers in
The vulnerable endpoint is proxy.php. According to IT-Connect and CyberSec Guru, the attack works only while the built-in CODE server is not running, such as during restarts, upgrades or crashes. That condition narrows the window, but restarts and upgrades are ordinary maintenance tasks, so it offers little protection.
Once inside, the attacker's commands did the rest. InfoSec Today describes one administrator's logs showing commands that wrote a one-line PHP web shell and tried to send system information to an external webhook address. That combination points to both persistence and reconnaissance.
Web shells matter because they let an attacker keep access after the first break-in. They usually run with the permissions of the web server account, so anything that account can read becomes part of the risk, as Cyber Security News explains.
Why disabling the Collabora app is not enough
Collabora's October 14 advisory is direct: disabling the app is insufficient, and administrators must either update or completely remove it, according to SC World. IT-Connect adds a detail that makes the problem worse, reporting that the vulnerable proxy script can still run even when the app is disabled. An administrator who switched the app off and moved on may still have an open door.
The earlier Collabora bug will not help here. Collabora says the attack path differs from CVE-2025-66208, and installing that earlier fix does not block this exploit. Teams that patched the previous issue should not assume this one is also closed.
What attackers wanted and what may have leaked
Reported attackers searched for credential stores and cryptocurrency wallets, according to SC World. The stakes extend beyond the server itself, since any credential stored on it or accessible from it could open other systems.
Whether data left the network is still unclear. One administrator saw no archive or upload commands in the logs reviewed, but the exposure scope is not established, per InfoSec Today. No source discloses how many servers were compromised, and none identifies a threat group behind the activity, according to Cyber Security News.
USA 24's earlier report on the OpenCode console breach, which may expose OpenAI, Anthropic and Google API keys, shows why rotating keys belongs in any response to a possible compromise.
How to tell if your Nextcloud server is hacked
Start with the steps that close the hole, then check for damage.
- Confirm whether the Collabora Built-in CODE Server app, identified as richdocumentscode, is installed on your server.
- Update to 26.4.303 or later, or fully remove the app. Disabling it alone is not enough.
- Look for unexpected PHP files, especially in the app and data folders, and review Nextcloud integrity-check alerts, as Forgenex recommends.
- If the server was exposed and unpatched, treat everything the web server account could read as potentially exposed, and rotate the credentials stored on or accessible from that server.
- Before concluding the server is clean, check for web shells. Patching closes the entry point but does not prove an existing shell is gone.
If you find a PHP file you did not create, assume an attacker has had a foothold. Bring in whoever handles incident response before you start deleting files, so you keep the evidence needed to see what was touched.
What to watch next for the Nextcloud flaw
CISA is the first thing to watch. Its October 14 alert and October 16 alert did not add this CVE to the Known Exploited Vulnerabilities catalog. A KEV listing would put federal agencies on a formal remediation clock and give private administrators a clearer benchmark.
The other open questions are how many servers were compromised, whether exploitation began before September 10, and which installation types are truly out of scope. Fast exploitation of internet-facing products is a familiar pattern, as seen in the Palo Alto PAN-OS zero-day CVE-2026-0322 that USA 24 covered earlier.
Expect more detail from the official advisory and from administrators sharing their own log findings. If a threat group or a count of affected servers surfaces, the story will shift quickly. Until then, any Nextcloud host running the Collabora app needs a check this week, and that check should include a search for web shells, not just an update.
