Collabora Built-in CODE Server flaw is exploited; CISA sets Oct 26 patch deadline

CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog on 2026-10-23, and the entry says the flaw is already being used in real attacks. It affects Collabora Online – Built-in CODE Server, the richdocumentscode app that many Nextcloud sites use to serve office documents without running a separate Collabora container. The federal remediation deadline is 2026-10-26 — a three-day window that signals how urgent this is.

A startup window that runs commands as the web server

Collabora's security advisory describes unauthenticated OS command injection in the richdocumentscode proxy. A crafted request through proxy.php causes an operating system command to execute as the web server user. The attack works only while the built-in CODE server is not running — right after a container restart, during an upgrade, or following a crash. That startup gap is exactly when many self-hosters stop watching the server, and it is why the advisory warns that disabling the app is not sufficient: richdocumentscode must be upgraded to version 26.4.303 or removed entirely.

Who is affected, and who is not

• Affected: Nextcloud instances with the Collabora Online – Built-in CODE Server app (richdocumentscode) at version 26.4.302 or older, per the advisory and the Nextcloud community thread that CISA links as a vendor reference. That thread, first posted on 2026-10-03, reports users finding webshells on compromised Nextcloud servers and cites a 9.2/10 severity for the CVE.
• EOL Nextcloud 29 and earlier: the advisory directs operators to upgrade Nextcloud or remove the app.
• Not affected: standalone Collabora Online deployments run via Docker or Linux distribution packages, hosted Collabora services, and Nextcloud sites using the richdocuments app without richdocumentscode installed.

Collabora also states this is not the same path as CVE-2025-66208 — patching that older issue does not protect you here.

What CISA's deadline does and does not require

The 2026-10-26 due date binds US federal agencies under Binding Operational Directive 26-04, not every consumer or business. CISA lists ransomware campaign use as "Unknown" and requires mitigations in line with vendor instructions and its forensics triage guidance. For non-federal operators, the practical translation is still clear: if your Nextcloud is reachable from the internet and runs the built-in CODE Server, treat this as patch-now, not patch-by-monthly-cycle.

Check your server before you close the ticket

Update richdocumentscode to 26.4.303 through the Nextcloud app store, or uninstall it if your users do not need built-in office editing. If the server ran unpatched during the exploitation window, assume the web-server user may have executed commands: look for unfamiliar files such as webshells in Nextcloud data and app directories, new or changed admin accounts, and unexpected outbound connections. Keep an eye on the KEV catalog entry and the vendor advisory for changes in scope or guidance.

If you run other self-hosted software, our guide to AI workflow automation covers keeping update and monitoring routines honest — the failure mode here was an unattended startup window, not an exotic exploit.