CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities (KEV) Catalog on October 23, 2026, citing evidence of active exploitation. The flaw affects Nextcloud’s optional richdocumentscode app, also known as Collabora Online - Built-in CODE Server. CISA’s October 26 due date applies to Federal Civilian Executive Branch agencies under BOD 26-04; the agency encourages other organizations to prioritize KEV vulnerabilities.
What CISA’s listing means
The catalog’s October 26, 2026, due date is tied to a federal directive, not a deadline for every Nextcloud operator. CISA says BOD 26-04 applies to Federal Civilian Executive Branch agencies and separately encourages all organizations to prioritize vulnerabilities listed in KEV. Its alert also explains the catalog addition and directive.
NeoTeo previously covered how CVE-2026-110447 differs from CVE-2025-66208.
Which Nextcloud setups are affected
The vulnerability is an unauthenticated operating-system command injection: a request to proxy.php can run a command with the web server user’s privileges without first logging in. Collabora says exploitation is possible while the built-in CODE server is stopped, including during a restart or upgrade, or after a crash. The issue affects richdocumentscode versions before 26.4.303 and has a CVSS 4.0 score of 9.2, rated Critical.
The version threshold applies to the app, not to Nextcloud 29 alone. Collabora separately advises installations running end-of-life Nextcloud 29 or earlier to upgrade Nextcloud or remove the app. Collabora says standalone Collabora Online servers are not affected.
Update or remove the built-in app
Disabling richdocumentscode in Nextcloud is not enough. Collabora’s security advisory says to upgrade the app to version 26.4.303 or later, or remove it. Administrators should check the app’s version rather than relying on the Nextcloud platform version to identify exposure.
What incident reports say, and what to check
In an October 16 bulletin, ACN / CSIRT Italia reported one compromised Nextcloud server in Italy. The attacker installed three web shells and stole a configuration file containing database and service-mailbox credentials and application secrets. For that case, the agency reported no evidence of access to user documents, administrative privilege escalation, additional persistence, or lateral movement at the time of its bulletin.
CERT Polska said on October 20 that the vulnerability was being used in ransomware attacks. In an October 24 snapshot of CISA’s catalog, the field for known ransomware use was marked “Unknown.”
CERT Polska recommends checking apps/richdocumentscode for files matching shx*.php, access logs for requests to proxy.php?status containing %2e%2e, $(, or ${IFS}, and for attempted sudo commands by the web server account.
