A Nextcloud Collabora vulnerability is being exploited to plant web shells on servers, and switching the app off does not close it. CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog on 23 October 2026, with a 26 October deadline for US federal agencies. The fix is version 26.4.303.
Who Is Affected, and Who Is Not
Only the Built-in CODE Server app inside Nextcloud is vulnerable, not Collabora Online as a product. The distinction matters because the two are often confused, and most coverage names Collabora without saying which installation is at risk.
| Installation | Status | What to run |
|---|---|---|
| Built-in CODE Server app (richdocumentscode) in Nextcloud | Vulnerable below 26.4.303 | 26.4.303 or later |
| Standalone Collabora Online server | Not affected | No action for this flaw |
| Nextcloud 29 or earlier, now end of life | Vulnerable through the app | Upgrade Nextcloud, or remove the app |
Collabora rates the flaw critical at CVSS 9.2 on version 4 of the scale, and classifies it as OS command injection. The bug sits in the app’s proxy.php, which starts the local document server when a request arrives and the server is not already running. No login and no user interaction are needed to exploit it.
There is one narrowing condition. The advisory states the attack works only while the built-in CODE server is not running, giving a container restart, an upgrade or a crash as examples. A server whose document component never stops was not exposed through this path.
How to Close It in Four Steps
Updating the Nextcloud app is the fix; the toggle in the admin panel is not.
- Update the app: Move the Built-in CODE Server app to 26.4.303 or later from the Nextcloud apps panel.
- If you cannot update, remove it: Collabora’s advisory is explicit that disabling the app is not sufficient and users must upgrade to 26.4.303 or later, or remove the app.
- On end-of-life Nextcloud, upgrade the platform: Installations on Nextcloud 29 or earlier should upgrade Nextcloud itself or drop the app, since the patched app version is not an option for them.
- Treat an exposed server as suspect: The advisory covers the fix, not clean-up. Attacks reported by The Hacker News wrote web shell files to disk, and updating an app does not delete a file an attacker already placed.
That last point is the one most often missed after a patch lands. This site made the same distinction this week about a Plex Media Server flaw where patching does not clean an already-compromised server.
What Attackers Are Doing With Access
The goal appears to be credential theft rather than disruption. According to The Hacker News, attackers backdoored Nextcloud servers with a web shell and used it to run reconnaissance and hunt for credential stores, password manager artifacts and cryptocurrency wallets.
Several security outlets place the start of exploitation in September 2026, around a month before Collabora published its advisory on 14 October 2026. No vendor has confirmed a start date, and no count of compromised servers has been published by Collabora, Nextcloud or CISA.
The flaw was reported by a researcher credited in the advisory as wwwshellcodeit.
The Second Flaw CISA Added the Same Day
CISA listed a second actively exploited vulnerability on 23 October, in Arista’s VeloCloud Orchestrator, with the same 26 October deadline. It is an SQL injection flaw tracked as CVE-2026-114625.
- Scores: Arista publishes a CVSS version 3.1 base score of 9.9 and a version 4.0 score of 9.4.
- Affected builds: VeloCloud Orchestrator On-Prem below 5.2.3.18, below 6.1.3.10 and below 6.4.2.12. Hosted and dedicated instances were affected but are already patched, and Arista says end-of-support versions have not been assessed.
- What it gives an attacker: Any authenticated user can reach operator privileges and impersonate a local superuser operator account, exposing internal-only functions.
- What it requires: Network access to the orchestrator’s web interface and a valid session. The lowest built-in tenant role, Enterprise Read Only, is enough.
- Indicators: Arista names two source addresses seen in attacks, 74.82.197.86 and 38.54.50.151, and advises blocking them and searching access logs for them.
Arista states in its advisory of 22 October 2026 that the issue “is known to be actively exploited”, while declining to name a threat actor, publish technical detail or say how many customers were hit. Where an upgrade is not yet possible, the company recommends restricting the web interface to trusted administrative networks and watching for unexpected outbound traffic from the host.
What CISA Requires, and By When
Both entries carry a remediation date of 26 October 2026. As of 25 October 2026 that leaves one day, and neither flaw has been linked to a known ransomware campaign, which CISA records as “Unknown” for both.
The obligation runs through Binding Operational Directive 26-04, which sets vulnerability management requirements for Federal Civilian Executive Branch agencies; CISA’s alert of 23 October cites that directive rather than the older BOD 22-01. Both entries also carry a forensic triage requirement, meaning affected agencies are expected to look for evidence of compromise rather than simply install the update. For everyone else the catalog is advice, not law: CISA says it encourages all organisations to adopt risk-based vulnerability management and prioritise remediation of catalog entries.
Short deadlines of this kind are now routine. Readus247 covered a two-day window earlier this month when an Ivanti Connect Secure zero-day drew a CISA deadline of 16 October, and the pattern of publishing fixed version numbers without upgrade guidance appeared again in the PHP2Shell vulnerability and its four fixed versions.
What Is Still Unknown
- Attribution: Nobody has been named as responsible for either campaign.
- Scale: No figure exists for how many Nextcloud servers or VeloCloud deployments were compromised.
- Ransomware involvement: Recorded as unknown by CISA for both entries, which is not the same as ruled out.
- Exploitation start: Reported as September for the Collabora flaw, but unconfirmed by the vendor.
Frequently Asked Questions
Is My Nextcloud Server Affected?
It is at risk if it runs the Built-in CODE Server app below version 26.4.303. Check the app version in the Nextcloud apps panel.
Does Disabling the Collabora App Fix It?
No. Collabora says switching the app off leaves the problem in place. You need the patched version, or the app removed entirely.
Which Version Fixes CVE-2026-110447?
Version 26.4.303 of the Built-in CODE Server app, or anything newer.
Is a Standalone Collabora Online Server at Risk?
No. The advisory limits the problem to the richdocumentscode app used inside Nextcloud.
What Is the Deadline?
26 October 2026 for US federal civilian agencies, under CISA’s catalog listing. Other organisations face no legal deadline, though the flaw is already being exploited.
