Nextcloud's built-in CODE app needs an update, not just disabling CISA now lists the Collabora flaw as exploited. A stopped document server creates the opening; standalone Collabora deployments are outside this advisory.