CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities (KEV) Catalog on October 23, 2026, citing evidence of active exploitation. Collabora says the flaw affects Nextcloud’s built-in richdocumentscode app before version 26.4.303. Administrators should update the app to 26.4.303 or later, or remove it; disabling it is not enough.

What CVE-2026-110447 affects

The vulnerability is in Nextcloud’s optional Collabora Online - Built-in CODE Server app, richdocumentscode. Collabora says an unauthenticated request to proxy.php can run an operating-system command with the web-server user’s permissions while the built-in CODE server is stopped, including during a restart, upgrade or crash. “Unauthenticated” means the request does not require the attacker to sign in.

The affected-version threshold is for the app, not for Nextcloud itself: richdocumentscode versions earlier than 26.4.303 are affected. Collabora’s security advisory identifies 26.4.303 as the fixed version.

How to remediate the built-in app

Update richdocumentscode to 26.4.303 or later, or remove it. Collabora says disabling the app does not remove the vulnerable proxy.php endpoint. For Nextcloud 29 or earlier, Collabora recommends upgrading Nextcloud or removing the app because those releases cannot install the fixed app version.

Which Collabora deployments are outside this flaw

Standalone Collabora Online servers are not affected by CVE-2026-110447. CERT Polska also excludes Nextcloud Office (richdocuments) installations that connect to an external Collabora server. The affected configuration is the built-in richdocumentscode app.

This is a different attack path from CVE-2025-66208. Collabora says that fixing the earlier vulnerability does not prevent CVE-2026-110447. NeoTeo previously covered why the two CVEs are distinct.

Who must follow CISA’s federal directive

CISA’s BOD 26-04 applies only to Federal Civilian Executive Branch (FCEB) agencies. The October 26, 2026, deadline is specific to those agencies, not all U.S. Nextcloud operators. CISA’s October 23 alert says the directive prioritizes KEV-listed vulnerabilities on publicly exposed assets where exploitation can grant total control, defers lower-risk vulnerabilities, and sets basic expectations for checking whether a system was compromised before patching. CISA encourages other organizations to prioritize KEV vulnerabilities through risk-based vulnerability management.

Indicators CERT Polska recommends investigating

CERT Polska reported active use of CVE-2026-110447 in ransomware attacks and server takeovers in its October 20, 2026, advisory. It recommends checking for these signs:

  • Files matching shx*.php in apps/richdocumentscode.
  • Access-log requests to proxy.php?status containing %2e%2e, $( or ${IFS}.
  • Attempts to run sudo from the web-server account.

CERT Polska presents these as investigation indicators. Their presence warrants further investigation, but does not by itself prove a server was compromised. Its advisory also recommends updating the app or removing it.