Critical RCE in Collabora Online CODE Server (CVE‑2026‑110447) Enables Backdoor of Nextcloud Deployments
What It Is – A command‑execution vulnerability (CVE‑2026‑110447) in the Collabora Online ‑ Built‑in CODE Server app for Nextcloud allows an unauthenticated attacker to send a crafted request to proxy.php, triggering OS command injection and planting a PHP web‑shell.
Exploitability – Public exploits appeared in mid‑September 2026, a month before the official advisory and CVE publication. Active exploitation is confirmed in the wild.
Affected Products – Collabora Online ‑ Built‑in CODE Server app (richdocumentscode) versions < 26.4.303, when used inside Nextcloud installations. Stand‑alone Collabora servers, Docker/RPM/DEB packages, and Nextcloud All‑in‑One are not affected.
Why It Matters for Trust & Control Assurance
- Continuous monitoring of third‑party components is essential; a delayed CVE publication left many administrators unaware of the risk.
- Demonstrable patch‑management evidence (e.g., version inventories, upgrade logs) provides a defensible audit trail for SOC 2, ISO 27001, or NIST CSF assessments.
- Controlling the software supply chain—verifying that only approved, up‑to‑date modules run in production—reduces the attack surface that threat actors can exploit.
Recommended Actions
- Upgrade the Collabora CODE Server app to version 26.4.303 or later immediately.
- If the built‑in app is not required, remove it entirely from the Nextcloud environment.
- Capture and retain upgrade logs and version inventories as evidence of remediation.
- Implement continuous third‑party risk monitoring to alert on vulnerable component releases.
Source: BleepingComputer – Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers