Nextcloud Servers Were Exploited 34 Days Before Collabora's CVE-2026-110447 Existed

An unauthenticated attacker can run operating-system commands as the web server user on a Nextcloud server running the Collabora Online Built-in CODE Server app before version 26.4.303, provided the bundled document server is stopped (after a restart, upgrade or crash). CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog on Oct. 23 with a federal due date of Oct. 26.

The fix is 26.4.303 or later, or removing the app. Collabora's advisory GHSA-g3vx-3m76-fghh says disabling the app does not prevent the attack. Standalone Collabora Online servers are not affected, and neither are Docker or package installs of Collabora or Nextcloud All-in-One, according to BleepingComputer.

The timeline runs backwards from the CVE

The order of events matters more than the score here. An administrator who waited for an advisory had no CVE to act on for 34 days after the first logged attack.

Date (2026)	Event	Source
Sept. 9	Fix committed	BleepingComputer
Sept. 10	Earliest exploit requests in a reporter's logs	GitHub issue 354
Sept. 11	26.4.303 released; issue 354 opened	GitHub issue 354
Oct. 3	Nextcloud forum warns the update fixes an injection "already being exploited"	Nextcloud forum
Oct. 14	Advisory and CVE published	Collabora advisory
Oct. 23	CISA adds it to KEV	CISA

The reporter on issue 354, the user HeikoBw, saw GET requests to /apps/richdocumentscode/proxy.php?status carrying ${IFS} whitespace tricks and base64 payloads piped to sh. They wrote PHP web shells named shx*.php and posted system information to webhook.site. On one machine the attacker searched for password-manager databases and cryptocurrency wallets. The reporter found no archive or upload commands.

On Sept. 30 a commenter, zaicurity, asked what 26.4.303 changed, because the release notes mentioned no security fix, and asked for a CVE. A user named ahlund found the compromise through failed sudo alerts on Sept. 18.

What the score says and omits

The CVE record carries two scores: 9.2 on CVSS 4.0 (vector AV:N/AC:L/AT:P/PR:N/UI:N) and 9.8 on CVSS 3.1 from NVD. The AT:P in the newer vector is the precondition that the CODE server be stopped. The score understates how that precondition behaves in practice: administrators restart containers and upgrade often, and exploitation began a day before the fix shipped.

Why the CVE took 33 days after the fix

Collabora attributed the delay "primarily to GitHub CVE-processing backlogs," which it said AI-driven security reports have strained, BleepingComputer reports. Nextcloud said Collabora reported the flaw in mid-September, that an update was available through its app store, and that it "had not observed widespread exploitation." BleepingComputer cites Second Security, which measured a median gap of 39 days between a public fix and CVE publication in August, up from 5.1 days in January.

Two other flaws CISA listed on Oct. 20 were covered earlier on this site: the SiteGuard WAF flaw, where patching can erase evidence, and Plex2Shell, which CISA split into Oct. 23 and Nov. 3 deadlines.

What to check on a Nextcloud server

Upgrade richdocumentscode to 26.4.303 or later, or remove it. Nextcloud 29 and earlier are end-of-life, and a forum reply by awelzel says the fixed app needs at least Nextcloud 30.

Look for unexpected PHP files in apps/richdocumentscode/. eSecurityPlanet lists shx*.php and shrf4645.php; a forum user, Andreabont, found a differently named backdoor, Nx_33143.php, on Nextcloud 35.0.2 on Oct. 16. Review access logs back to Sept. 10 for proxy.php?status requests containing $( or ${IFS}, and rotate any credential the web server account could read. Patching does not remove a web shell already in place.

CISA's due date for federal agencies is today, Oct. 26. Collabora's advisory credits a reporter named wwwshellcodeit and lists no workaround other than upgrading or removing the app.