CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog on October 23. It affects Nextcloud’s optional Collabora Online – Built-in CODE Server app, identified as richdocumentscode. Administrators should upgrade it to 26.4.303 or later, or remove it.

The Collabora advisory, published October 14, lists versions before 26.4.303 as affected. Today’s CISA catalog entry is a new exploitation-priority signal, not the vulnerability’s publication date or first attack date.

A stopped server creates the opening

An unauthenticated request to the app’s PHP proxy can execute operating-system commands as the web-server user. The built-in CODE server must be not running, such as during a restart, upgrade or crash. No user interaction is required.

Keeping it running is a fragile defense because ordinary maintenance can create that condition. Collabora explicitly warns that disabling the app is insufficient: upgrade or remove it.

The scope is specific. Standalone Collabora Online servers are unaffected. In its October 15 explanation, Collabora also excludes its Docker images, RPM/DEB packages and Nextcloud All-in-One images. Check which component is installed before assuming that every Nextcloud or Collabora deployment shares this exposure.

Exploitation predates the catalog listing

Exploitation status: CISA-listed known exploitation, with administrator-reported intrusions described in independent reporting. Bill Toulas at BleepingComputer reported on October 15 that administrators had found planted PHP webshells, files attackers can use for continued remote control.

That report describes attack reports dating to September and a fixed release on September 11. The October 14 advisory and October 23 catalog addition came later. BleepingComputer could not independently confirm separate ransomware claims; CISA lists ransomware-campaign use as Unknown.

CISA gives an October 26 remediation deadline under its applicable federal requirements and marks forensic triage Yes. That federal deadline is not a grace period for other exposed operators.

Fix the app and assess earlier access separately

  • Upgrade richdocumentscode to 26.4.303 or a later fixed version, or remove it. Verify the installed app version after maintenance.
  • For end-of-life Nextcloud 29 or older, upgrade Nextcloud or remove this app. This is the maintainer’s explicit guidance.
  • Preserve and review evidence of earlier access. CISA calls for forensic triage; the reported webshells mean a package update alone cannot establish that an already-compromised server is clean.
  • Use incident-response procedures if compromise is found. Containment, recovery from trusted sources and replacement of exposed credentials address a different problem from closing the entry point.

Collabora maintains and sells the affected product family. Its advisory supplies the exact version and deployment boundaries; CISA and BleepingComputer provide the separate exploitation context.

Caveat: the reviewed sources give no reliable total of compromised servers, and a patched app cannot prove that earlier access never occurred.