Critical flaw in Collabora Online CODE Server for Nextcloud

What it is and who is affectedCVE-2026-110447 is an OS command injection flaw (CWE-78) in Collabora Online – Built-in CODE Server, the Nextcloud app d...

What it is and who is affected

CVE-2026-110447 is an OS command injection flaw (CWE-78) in Collabora Online – Built-in CODE Server, the Nextcloud app distributed as richdocumentscode. According to the National Vulnerability Database (NVD) of NIST, versions before 26.4.303 are affected. The issue sits in proxy.php and allows remote code execution when the CODE server is not running, for example just after the product has been restarted.

The scope is narrower than it may first appear, and that matters. The vulnerability is not present in standalone Collabora Online servers; only the deployment that runs the built-in CODE Server inside Nextcloud is exposed. If your organisation uses Nextcloud for document editing through that app, you are in the target group. If you run Collabora Online as a separate server, this particular flaw does not apply to you. CISA describes the same behaviour: remote code execution when the CODE server is not running within the Nextcloud platform.

Severity is CVSS 4.0 9.2, CRITICAL, with a network attack vector, no privileges required and no user interaction. In practical terms, an attacker does not need an account or a convincing email: the exposure is the service itself.

Why it is urgent

This is not a theoretical risk. CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities (KEV) catalogue on 23 October 2026, which means there is confirmed exploitation in real attacks. The NVD notes exploitation in the wild during September and October 2026, and clarifies that this is a different vulnerability from CVE-2025-66208.

CISA set a remediation deadline of 26 October 2026 for US federal agencies, an unusually tight window that reflects the severity. Its required action is to apply mitigations in line with the vendor's instructions, following BOD 26-04 guidance on prioritising security updates by risk, and to assess each asset's internet exposure. Where mitigations are not available, CISA's guidance points to discontinuing use of the product. There is no indication in the available data that this vulnerability has been used in ransomware campaigns, but active exploitation alone is enough reason to treat it as urgent.

What to do today

Check whether you use it. Look for the richdocumentscode app in your Nextcloud instances and confirm the installed version. Anything below 26.4.303 falls within the affected range.
Update or mitigate. Apply the fix indicated in the vendor's advisory and in the Nextcloud community guidance referenced by CISA. Do not guess a corrected version beyond what the manufacturer states.
Look for signs of intrusion. Because the flaw allows command execution, review logs and file integrity on affected Nextcloud hosts, paying attention to activity around restarts, when the CODE server is down and the vulnerable path is reachable.
Reduce internet exposure. Restrict access to the Nextcloud instance and the CODE Server endpoint to the networks and users that genuinely need it, and review firewall rules and reverse proxy configuration.
Apply the same discipline elsewhere. Keep Nextcloud apps, PHP runtimes and web servers patched, and remove components you no longer use.

How a cybersecurity team such as ALMC's can help

For small and mid-sized companies in Barcelona, Lleida, Tarragona or Girona running their own Nextcloud, WordPress, PrestaShop or Joomla installations, the hard part is rarely reading the advisory; it is knowing what is actually installed, which services face the internet and what changed after an incident. That is where ALMC's cybersecurity work fits: security audits and pentesting to find vulnerabilities before they are exploited, server hardening, monitoring and incident response, and repair of websites that have already been compromised.

In a case like CVE-2026-110447, the work starts with an inventory of the Nextcloud deployment and its apps, continues with the update or mitigation indicated by the vendor, and ends with a review of logs and exposed services to confirm nothing was left open. All of it handled with GDPR in mind, since document platforms usually hold client and internal data. A short, well-documented intervention now is far cheaper than rebuilding a compromised environment later.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.