CVE-2026-110447 — a critical OS command‑injection flaw in the Collabora Online built‑in CODE Server app for Nextcloud — has been actively exploited since mid‑September, according to multiple administrator reports and the formal advisory published in October.
CVE-2026-110447: what is affected and what is not
The vulnerability, tracked as CVE-2026-110447, exists in the Nextcloud app richdocumentscode and affects versions prior to 26.4.303. Collabora says the flaw resides in the app’s mechanism for starting the bundled Collabora server and impacts only the optional built‑in CODE server app. Collabora explicitly stated that standalone Collabora Online servers, Docker and RPM/DEB installations, and Nextcloud All‑in‑One deployments remain unaffected.
How attackers are exploiting the flaw
According to reports compiled by BleepingComputer, attackers exploit the vulnerability by sending a malicious request to the app’s proxy.php endpoint, triggering an OS command injection. A key prerequisite for successful exploitation is that the built‑in CODE server is stopped — for example after a restart, upgrade, or crash. The exploitation vector requires neither authentication nor user interaction.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildObserved activity: webshells, searches for secrets, and possible ransomware
System administrators who reported malicious activity say attackers have planted PHP webshells on compromised servers and used them to hunt for credential stores and valuables, specifically password databases, password manager artifacts, and cryptocurrency wallets. Some users also reported that ransomware operators were leveraging the same flaw; BleepingComputer noted it could not independently confirm ransomware activity in every case.
Timeline: patch, community warnings, and CVE publication
The timeline in this case highlights a multi‑week gap between a code fix and formal vulnerability publication. Collabora committed a fix on September 9 and released version 26.4.303 on September 11. Maintainers issued mid‑September warnings to administrators, and a community warning urging immediate updates was published on October 3. The GitHub advisory and the CVE were not published until October 14 — more than four weeks after the fix and the app release.
Nextcloud told BleepingComputer that Collabora reported the vulnerability in mid‑September and that an update was made available through the app store; Nextcloud said it delayed public disclosure to give users time to update and that it had not observed widespread exploitation. Collabora attributed the delayed announcement primarily to GitHub CVE‑processing backlogs, which it said were under strain from increasing volumes of AI‑driven security reports.
Second Security study and the broader CVE lag problem
Researchers at Second Security provided context on the broader processing delays that affected this case. Their analysis of open‑source vulnerabilities found the median interval between public fixes and CVE publication was 39 days in August, up from 5.1 days in January. They reported that public exploit code often appears online within hours of a security fix and days before a CVE is published, and warned that AI tools make it easier for attackers to generate working exploits for published fixes.
What this means for system administrators, open‑source maintainers, and incident responders
- System administrators: administrators are advised to upgrade richdocumentscode to version 26.4.303 or later, or remove the built‑in CODE server app if it is not needed. Vendors warned that merely disabling the app is insufficient.
- Open‑source maintainers: the case underscores operational risk when fixes precede CVE publication by weeks, particularly as automated tooling can accelerate exploit development.
- Incident responders: reports from administrators of PHP webshells and searches for secrets indicate that rapid forensic triage and credential hygiene are immediate priorities on compromised systems.
The factual record in this case is compact but consequential: a fix was available on September 11, administrators reported exploitation dating back to roughly September 10, and the formal CVE and advisory did not appear until October 14. That sequence — fixes and public reports arriving before formal CVE publication — is the precise gap Second Security’s research identifies as increasing attackers’ windows of opportunity. Questions remain about the ultimate scale of compromise; Nextcloud said it had not observed widespread exploitation while administrators reported multiple compromises and planted webshells. For defenders, the immediate step is explicit and narrow: upgrade to 26.4.303 or remove the optional built‑in CODE server app, and treat any instance where the built‑in server was stopped as potentially compromised.
