US cybersecurity agency CISA has added a critical flaw in Nextcloud's built-in Collabora office server to its Known Exploited Vulnerabilities catalogue, with a federal deadline of 26 October 2026. The flaw, tracked as CVE-2026-110447, is an unauthenticated operating-system command injection in the proxy.php file of Collabora's built-in CODE Server, known as the richdocumentscode app for Nextcloud.

Who is affected

The flaw affects versions before 26.4.303 and is reachable when the local CODE server is not running, for example after a restart. Standalone Collabora Online servers are not affected. Exploitation was reported in September and October 2026, with attackers installing web shells on vulnerable Nextcloud instances and then hunting for credentials, password managers and crypto wallets, according to security reporting on the CISA listing.

What to do

Administrators running the built-in CODE server should update to version 26.4.303 or later, and check whether their systems were compromised before patching, since a web shell installed earlier would survive a patch. CISA's catalogue listing rests on evidence of active exploitation, and its directive requires federal civilian agencies to act by 26 October. The agency encourages all organisations to prioritise exploited flaws in the same way, even though the directive binds only federal agencies.

Self-hosted collaboration tools are common in small and medium organisations, which is why a flaw in a document-editing component can matter far beyond the server it runs on. Once an attacker gains a foothold on a web server, they can try to move to other systems on the same network. Patching, checking logs, and confirming that no unauthorised files remain are the immediate steps for affected administrators.