Overview
A critical remote command execution vulnerability in the Collabora Online – Built-in CODE Server app for Nextcloud is being actively exploited to compromise servers and install persistent webshells. Tracked as CVE-2026-110447, the flaw allows an unauthenticated attacker to execute operating system commands through the app’s proxy.php endpoint. What makes this incident particularly significant is not only the technical vulnerability, but the timeline. Administrators began reporting attacks around 10 September 2026, while the vulnerability fix was released on 11 September. The formal security advisory and CVE publication only followed on 14 October. The result is a familiar but increasingly important security problem: a vulnerability can be exploitable before the wider security ecosystem has a formal identifier for it.
The Built-In CODE Server Becomes the Attack Path
CVE-2026-110447 affects versions of the Nextcloud richdocumentscode app before 26.4.303. The vulnerable component is the optional built-in Collabora CODE server used to provide document collaboration functionality directly within Nextcloud. The attack requires the built-in CODE server to be stopped, such as following a restart, upgrade or crash. Once that condition exists, an attacker can send a malicious request to the proxy.php endpoint and trigger operating system command injection. No authentication or user interaction is required. This creates an unusual operational dependency: a service state that might normally be considered temporary can become the condition that exposes the underlying attack path.
Exploitation Goes Beyond Initial Access
Reports from affected administrators indicate that attackers did not simply execute a command and disappear. PHP webshells were reportedly planted to establish continued access to compromised systems. Attackers then searched for valuable information, including password databases, password-manager artefacts and cryptocurrency wallets. Some administrators have also reported possible ransomware exploitation. That activity has not been independently confirmed, so the distinction is important. However, the reported post-exploitation behaviour demonstrates why remote command execution on a collaboration server should be treated as a potential full-system compromise rather than merely a vulnerability requiring a routine application update. A patch can close the vulnerability. It cannot remove a webshell that was installed before the patch.
The Disclosure Gap Is Part of the Risk
Collabora released the security fix before the CVE was formally published. Administrators therefore had a working security update available, but without the familiar CVE identifier that many organisations depend on for vulnerability management, asset correlation and prioritisation. This is becoming a larger operational challenge. Research cited in the incident found that the median interval between public security fixes and CVE publication had increased substantially during 2026. The researchers linked part of the pressure to the growing volume of AI-assisted vulnerability discovery and reporting. There is another problem: once a security fix becomes public, attackers can analyse the difference between vulnerable and patched versions and develop exploits without waiting for the CVE record. The traditional sequence of CVE → assessment → patch → protection is therefore becoming less reliable.
Patch the Vulnerability — Then Investigate the Server
The immediate remediation for affected deployments is to upgrade the built-in CODE Server app to 26.4.303 or later. If the component is not required, removing it is another option. Importantly, simply disabling the application is not considered sufficient protection. For systems that may have been exposed during the exploitation window, remediation needs to go further. Web directories, PHP files, administrative accounts, authentication credentials, scheduled activity and other persistence mechanisms should be reviewed. Affected credentials may also require rotation where compromise cannot be excluded. Standalone Collabora Online deployments, Docker and RPM/DEB installations, and Nextcloud All-in-One deployments are stated to be unaffected by this particular flaw.
Expert in the Cloud Insight
CVE-2026-110447 highlights a security principle that is becoming increasingly important: the absence of a CVE does not mean the absence of a vulnerability. Security teams need visibility into vendor advisories, application release notes, security mailing lists and unusual behaviour—not only centralised vulnerability databases. The bigger lesson is architectural. A security fix closes an attack path; it does not prove that the attacker never used it. When exploitation can begin weeks before formal disclosure, vulnerability management must combine patch intelligence with compromise assessment and behavioural detection.
Leave a Reply