Hackers Exploit CVE-2026-110447 to Backdoor Nextcloud Servers

A critical vulnerability tracked as CVE-2026-110447 is being exploited against some Nextcloud deployments running the Collabora Online Built-in CODE Server, allowing unauthenticated attackers to execute operating system commands and potentially establish persistent access.

The flaw affects the Nextcloud richdocumentscode app before version 26.4.303 and has a CVSS 4.0 score of 9.2.

The vulnerability is an OS command injection in proxy.php. No authentication or user interaction is required, but exploitation depends on an important condition: the Built-in CODE server must not be running when the malicious request reaches the vulnerable proxy.

This can happen during a container restart, software upgrade, service crash or another temporary outage.

For broader coverage of enterprise vulnerabilities and exploited CVEs, see our CVE & Vulnerability Exploits Security Hub.

Key Technical Findings

• CVE-2026-110447 is an unauthenticated OS command-injection vulnerability affecting the Nextcloud richdocumentscode app.
• Versions earlier than 26.4.303 are affected; version 26.4.303 contains the fix.
• The vulnerable path is proxy.php.
• Exploitation requires the Built-in CODE server to be temporarily unavailable.
• Commands execute as the web server user, not automatically as root.
• NVD states that the vulnerability was exploited in the wild during September and October 2026.
• Standalone Collabora Online servers are not affected by this specific vulnerability.

What CyberUpdates365 Independently Verified

CyberUpdates365 independently cross-checked the public Collabora security advisory, Collabora’s vendor guidance, the NVD CVE record and the original public GitHub incident discussion before preparing this report.

Across those sources, we independently verified the following points:

• The affected component is the Nextcloud Collabora Online Built-in CODE Server app, also known as richdocumentscode.
• The vulnerable versions are earlier than 26.4.303.
• Version 26.4.303 contains the security fix.
• The vulnerability is an OS command injection in proxy.php.
• The vulnerable condition occurs while the Built-in CODE server is not running.
• Commands execute in the context of the web server user.
• Simply disabling the app is not sufficient; the vendor says it must be upgraded or removed.
• Standalone Collabora Online deployments are outside the affected configuration.
• CVE-2026-110447 is separate from CVE-2025-66208 and uses a different attack path.

We did not independently execute the exploit against a live Nextcloud environment and do not claim to have reproduced the vulnerability. Exploitation claims in this article are therefore attributed to the vendor, the CVE record and publicly documented administrator reports where appropriate.

What Is CVE-2026-110447?

CVE-2026-110447 is a critical command-injection vulnerability in the Built-in CODE Server integration used by some Nextcloud installations to provide Collabora Online document editing.

The affected application is:

richdocumentscode

The vulnerable component is:

proxy.php

A specially crafted unauthenticated request can cause an operating system command to execute under the privileges of the web server account.

The underlying weakness is classified as:

CWE-78: Improper Neutralization of Special Elements used in an OS Command

Only Built-in CODE Server Deployments Are Affected

CVE-2026-110447 should not be interpreted as a vulnerability in every Nextcloud or Collabora Online installation.

The affected configuration uses the optional:

Collabora Online - Built-in CODE Server

for Nextcloud.

Collabora states that standalone Collabora Online servers are not affected.

The vendor also describes the Built-in CODE configuration as a minority deployment primarily intended for simpler or home-user installations rather than its recommended production deployment model.

Affected and Fixed Versions

Attack Chain Analysis

Based on the vendor advisory, CVE record and available public incident information, the attack path can be broken down into the following stages.

1. Attacker Finds an Exposed Nextcloud Deployment

The attacker first needs a Nextcloud instance running a vulnerable version of the Built-in CODE Server app.

Version alone is not enough for exploitation because another runtime condition must also exist.

2. The CODE Service Becomes Temporarily Unavailable

The vulnerable proxy behavior becomes exploitable while the Built-in CODE server is not running.

Vendor-documented examples include:

• Container restart
• Application upgrade
• Service crash

This creates a potentially short-lived attack window.

3. A Crafted Request Reaches proxy.php

During that window, an unauthenticated attacker can send a malicious request to the vulnerable proxy handler.

Improper handling of attacker-controlled input allows data to reach an operating system command context.

4. The Command Runs as the Web Server User

Successful exploitation results in command execution using the privileges of the web server process.

This is a critical distinction.

CVE-2026-110447 does not automatically provide root privileges.

However, access as the web server user may still expose application files, credentials, configuration data and writable web directories depending on how the server is configured.

5. Persistent Access May Be Established

Public Nextcloud community reports associated with the vulnerability describe unexpected web shells being discovered on affected systems.

A web shell can allow an attacker to continue executing commands after the original vulnerable service condition has disappeared.

The presence of a web shell should therefore be treated as evidence of compromise rather than merely evidence of exposure.

6. Installing the Patch Does Not Remove Existing Persistence

Upgrading to a fixed version closes the original vulnerable code path.

It does not automatically delete web shells, unauthorized scheduled tasks, modified application files or other persistence that may already have been created.

This is why patching and incident investigation must be treated as separate tasks.

Why the Short Exploit Window Still Matters

At first glance, a vulnerability that works only while a service is stopped may appear difficult to exploit.

CyberUpdates365 believes that interpretation understates the operational risk.

An internet-facing attacker does not necessarily need to know exactly when a restart will occur. Automated infrastructure can repeatedly probe exposed systems and wait for the required state.

Normal administrative events such as upgrades and container restarts can therefore become security-relevant windows.

This interpretation is based on the vendor-documented exploit requirement. It is CyberUpdates365 analysis, not a claim that Collabora documented a specific automated exploitation framework.

Active Exploitation Has Been Reported

The NVD description for CVE-2026-110447 states that the vulnerability was exploited in the wild during September and October 2026.

A public GitHub issue opened before the coordinated disclosure also documents an administrator running version 26.4.302 who subsequently upgraded to 26.4.303 after suspicious activity was investigated.

Nextcloud community discussion has additionally warned administrators about compromised hosts and web shells.

Public evidence currently does not establish:

• A single named threat actor
• A confirmed nation-state attribution
• A reliable global victim count
• One standard post-exploitation toolset used in every compromise

This Is Not the Same as CVE-2025-66208

Collabora explicitly states that CVE-2026-110447 follows a different attack path from CVE-2025-66208.

The fix for the older vulnerability does not protect against CVE-2026-110447.

Administrators should therefore verify the actual installed richdocumentscode version instead of assuming that an earlier security update provides protection.

Disabling the App Is Not a Valid Fix

One of the more important remediation details in Collabora’s advisory is that simply disabling the affected application is not sufficient.

Administrators should:

• Upgrade richdocumentscode to 26.4.303 or later, or
• Remove the Built-in CODE Server app entirely.

Collabora also advises users of end-of-life Nextcloud 29 and earlier to upgrade Nextcloud or remove the affected application.

Detection and Investigation

Administrators who exposed a vulnerable version to the internet should investigate the host even after applying the update.

1. Confirm Whether richdocumentscode Is Installed

Check the Nextcloud application inventory and determine whether:

richdocumentscode

is installed.

If the app is not present and the environment uses standalone Collabora Online instead, this specific CVE does not apply.

2. Determine the Previously Installed Version

Do not look only at the current version.

Review package history, deployment records, backups or configuration-management history to determine whether the system previously ran a version earlier than:

26.4.303

A currently patched server may still have been exposed before the upgrade.

3. Review Requests to the Vulnerable Proxy

Inspect web server and reverse-proxy logs for suspicious traffic involving:

/apps/richdocumentscode/proxy.php

Give extra attention to requests occurring around:

• CODE service restarts
• Nextcloud upgrades
• Container restarts
• Service crashes

4. Search for Unexpected PHP Files

Look for PHP scripts administrators did not deploy, particularly in web-accessible or writable locations.

Compare files against:

• Known-good backups
• Package manifests
• Deployment artifacts
• Version-control records

Creation and modification timestamps around the suspected exposure period can help prioritize investigation.

5. Look for Suspicious Web Server Child Processes

Review operating system telemetry for unexpected commands or child processes started by:

• The web server
• PHP
• PHP-FPM
• Other Nextcloud-associated processes

Commands that do not match normal application behavior deserve investigation.

6. Review Outbound Connections

Look for unexplained outbound network connections originating from the web server account or PHP processes.

A web shell may be used to retrieve additional payloads or communicate with attacker infrastructure.

7. Check for Secondary Persistence

Depending on the privileges available to the compromised account, inspect relevant persistence locations including:

• Cron jobs
• Modified application files
• Web-accessible scripts
• Unexpected SSH keys where permissions allow modification
• New local accounts where privileges allow creation
• Systemd units where applicable
• PHP configuration changes

Do not assume every listed mechanism is possible on every compromised system. Investigation should reflect the actual permissions of the web server account.

Patch Verification: Confirm the Fix Is Actually Running

Updating a package is only the first step. Administrators should confirm that the patched version is the version actually loaded by the production system.

Step 1: Verify the Installed Version

Confirm that richdocumentscode reports:

26.4.303 or later

Step 2: Verify the Running Deployment

For containerized or automated deployments, confirm that the currently running instance was rebuilt or restarted using the patched application files.

An updated package repository does not prove that an existing container or cached image is using the fix.

Step 3: Complete Required Service Restarts

Restart the relevant services according to the deployment’s normal update procedure.

Step 4: Check the Version Again

After services return, verify the active app version a second time.

This catches situations in which a deployment rollback, stale container image or configuration-management process restores an older copy.

Step 5: Verify Exposure History Separately

A successful version check proves that the fixed code is now installed.

It does not prove that an attacker never exploited the previous version.

Complete log and filesystem investigation before declaring a previously vulnerable internet-facing system clean.

Confirmed vs Unconfirmed

Confirmed

• CVE-2026-110447 affects richdocumentscode before 26.4.303.
• The vulnerability is an OS command injection in proxy.php.
• Authentication is not required.
• User interaction is not required.
• The attack requires the Built-in CODE server to be unavailable.
• Commands execute as the web server user.
• Standalone Collabora Online servers are not affected.
• Version 26.4.303 contains the fix.
• Simply disabling the affected application is not considered sufficient remediation by Collabora.
• NVD describes the vulnerability as exploited in the wild during September and October 2026.

Reported but Not Universally Verified

• Public Nextcloud community reports describe web shells on compromised systems.
• Individual administrator reports provide evidence of real-world incidents, but they do not establish the full scale of exploitation.

Currently Unconfirmed

• The identity of the attacker or attackers
• A specific nation-state connection
• The total number of compromised servers
• A universal malware payload associated with exploitation
• Automatic root compromise
• A single post-exploitation chain common to every victim

CyberUpdates365 Analysis

The most important defensive issue in CVE-2026-110447 is the difference between vulnerability remediation and compromise remediation.

The patch addresses the command-injection entry point, but public reports of web shells mean administrators cannot automatically treat a successful upgrade as proof that a previously exposed host is trustworthy.

The exploitation condition also creates an unusual monitoring problem. A service can appear secure during normal operation while becoming exploitable for a short period during a restart or failure.

For defenders, this means historical telemetry may be more valuable than a simple current-state vulnerability scan.

A vulnerability scanner run after patching may correctly report that CVE-2026-110447 is no longer present while completely missing persistence created before the update.

Organizations that previously exposed an affected version should therefore answer two separate questions:

1. Is the vulnerable code still present?
2. Was the host compromised while that code was present?

Those questions require different evidence and should not be treated as interchangeable.

Research Evidence

What Administrators Should Do Now

• Determine whether the Built-in CODE Server app is installed.
• Identify both the current and previously installed versions.
• Upgrade to 26.4.303 or later immediately.
• Remove the application if it is not required.
• Do not rely on merely disabling the vulnerable app.
• Upgrade unsupported Nextcloud deployments.
• Review proxy and web server logs for suspicious activity.
• Investigate unexpected PHP files and web shells.
• Review child processes started by the web server or PHP.
• Check outbound connections and relevant persistence mechanisms.
• Rebuild from a known-good state if investigation establishes compromise and system integrity cannot be confidently restored.

Frequently Asked Questions

What is CVE-2026-110447?

CVE-2026-110447 is a critical unauthenticated OS command-injection vulnerability affecting the Collabora Online Built-in CODE Server app for Nextcloud.

Is CVE-2026-110447 actively exploited?

The NVD record states that the vulnerability was exploited in the wild during September and October 2026.

Does it affect every Nextcloud server?

No. The server must use the vulnerable Collabora Online Built-in CODE Server app. Nextcloud deployments using other document-server configurations are not automatically affected.

Does it affect standalone Collabora Online?

No. Collabora specifically states that standalone Collabora Online servers are not affected by CVE-2026-110447.

Which version fixes the vulnerability?

The vulnerability was fixed in richdocumentscode version 26.4.303.

Does exploitation provide root access?

Not automatically. Vendor documentation states that commands execute as the web server user.

Can administrators simply disable the app?

No. Collabora says the application must be upgraded to version 26.4.303 or later or removed.

Is installing the update enough after a compromise?

No. Updating removes the vulnerable entry point but does not automatically remove a web shell or other persistence installed before the update.

Is CVE-2026-110447 related to CVE-2025-66208?

They affect related software, but Collabora says CVE-2026-110447 uses a different attack path and is not prevented by the earlier fix.

Final Takeaway

CVE-2026-110447 is a critical, reportedly exploited vulnerability, but its scope is narrower than headlines suggesting that all Collabora or Nextcloud servers are vulnerable.

The issue specifically affects vulnerable versions of the optional Built-in CODE Server app and requires the CODE service to be temporarily unavailable.

That narrow condition does not make the risk insignificant. Routine restarts, upgrades and crashes can create the required exploit window.

Administrators should upgrade to version 26.4.303 or later and separately determine whether their systems may have been compromised before patching.

A patched server is no longer vulnerable to this specific flaw. It is not automatically proof that the server was never compromised.

Official Sources

• Collabora Online Security Advisory — CVE-2026-110447
• Collabora Online — Security and Upgrade Guidance
• NVD — CVE-2026-110447
• Collabora richdocumentscode — Public Incident Discussion