Collabora Online CVE-2026-110447: Built-in CODE Server RCE exploited in the wild

CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog on October 23, giving US federal agencies until October 26 to act. It is an unauthenticated OS command injection in the Collabora Online Built-in CODE Server — the richdocumentscode app that ships document editing inside Nextcloud — and it carries a CVSS 4.0 base score of 9.2. The uncomfortable part is not the score. It is that the flaw has been exploited in the wild since September, that the vulnerable window opens every time the service restarts, and that administrators are finding web shells that survive the patch.

Developing story — first published 09:43 CEST (07:43 UTC), October 24, 2026. Updated as the vendor and CISA publish more.

At a glance

CVE	CVE-2026-110447
Product / affected versions	Collabora Online – Built-in CODE Server (richdocumentscode) · versions before 26.4.303 · only the Nextcloud app is affected; standalone Collabora Online and the Docker/Linux-package CODE server are not
Fixed in	richdocumentscode 26.4.303
CVSS	9.2 Critical · CVSS 4.0 · scored by MITRE as CNA (Secondary); NVD has no primary score · vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Exploited in the wild	Yes · September–October 2026 per NVD; Nextcloud administrators report finding web shells
CISA KEV	Added 2026-10-23; federal due date 2026-10-26 (BOD 26-04, forensic triage required)
Public PoC	No vendor-published PoC as of 2026-10-24; exploitation observed by Nextcloud administrators
Official advisory	GHSA-g3vx-3m76-fghh

What happened

Nextcloud's built-in document editor runs a bundled Collabora Online Development Edition (CODE) server. Requests from the browser hit a PHP endpoint, proxy.php, which forwards them to that local CODE server. When the CODE server is not running — immediately after a container restart, an upgrade, or a crash — proxy.php falls into a code path that starts it by building a shell command and running it through PHP's exec. Attacker-controlled input in the request reaches that command without sanitization. The result, per the vendor advisory, is arbitrary operating-system commands executed as the web-server user, with no authentication.

That "when the CODE server isn't running" precondition is why the CVSS 4.0 vector carries AT:P (attack requirements present) rather than a clean 9.8 — the attacker needs the service to be down. In practice that is not much of a barrier: the window opens on every restart, and a patient attacker can simply keep probing proxy.php until it does. The NVD record states exploitation in the wild in September and October 2026, and notes this is a distinct bug from the earlier CVE-2025-66208 — the fix for that one does not close this path.

The vendor published the advisory on October 14; the first warning to administrators went up on the official Nextcloud forum on October 3, before a CVE existed. CISA's KEV entry landed on October 23 with forensicTriage: Yes — the directive expects you to assume compromise and check, not merely patch.

Who is exposed, and how to check

You are affected only if you run the built-in CODE server app inside Nextcloud. To check from the command line on the Nextcloud host:

sudo -u www-data php occ app:list | grep -i richdocumentscode

If richdocumentscode is listed at 26.4.302 or earlier, you are vulnerable. You are not affected if you serve documents with richdocuments pointed at a separate Collabora Online server (Docker image, Linux package, or a hosting provider) — only the self-contained CODE app embeds the vulnerable proxy.php.

"We just patched it" is not the end of the conversation here. If you were running a vulnerable version any time since early September and your CODE server ever restarted, assume the window was open and go looking — the patch stops new injection, it does not remove a shell an attacker already dropped.

Remediation

1. Am I affected? Run the occ app:list check above. Anything below richdocumentscode 26.4.303 is in scope. Internet-facing Nextcloud instances with the built-in editor are the priority.

2. Patch — exact fixed version. Update the Built-in CODE Server app to richdocumentscode 26.4.303 or later (Apps → your installed apps → update, or sudo -u www-data php occ app:update richdocumentscode). The vendor is explicit that disabling the app does not help — the vulnerable proxy.php still ships. If you cannot update immediately, remove the app and serve documents from a standalone Collabora Online server instead. Nextcloud instances at end-of-life (≤ 29) should upgrade Nextcloud first.

3. Can't patch now? Compensating controls. Remove richdocumentscode rather than leaving a disabled-but-present copy. If removal is not possible this hour, restrict network reach to the Nextcloud instance and front it so that proxy.php is not reachable by unauthenticated clients — but treat this as a stopgap measured in hours, not a fix.

4. Hunt for compromise. Administrators on the official Nextcloud forum report concrete indicators — treat these as community-reported, not vendor-confirmed, and verify against your own evidence:

• A dropped web shell at ./apps/richdocumentscode/Nx_33143.php reported to contain a one-line system($_GET[c]) backdoor; earlier filenames followed shx* and shrf* patterns.
• Unexpected .php files anywhere under apps/richdocumentscode/ — the integrity check flags them as EXTRA_FILE (sudo -u www-data php occ integrity:check-app richdocumentscode).
• Web-server access-log hits to proxy.php (including proxy.php?status) — review back to September 10, 2026.

Map this to MITRE ATT&CK: initial access via exploit of a public-facing application (T1190), a web-shell for persistence (T1505.003), and command execution through the web-server user (T1059).

5. Eradicate and verify. Remove any web shell you find, then rotate every credential the web-server user could read — database passwords, app passwords, API tokens, mail credentials — because command execution as www-data means those were readable. Patch and then re-check: a shell planted before the upgrade persists after it, and even after the app is removed. The only safe conclusion is one you reached by inspecting the host, not by reading the version string. For the deadline framing, see the CISA BOD 26-04 risk-based patching guide.

What is not known yet

• No public attribution. Who is exploiting this, and whether it is opportunistic scanning or a targeted campaign, has not been stated by the vendor or CISA.
• Scale. There is no published count of compromised instances; the signal is forum reports of web shells, not a vendor telemetry figure.
• Ransomware use. CISA lists knownRansomwareCampaignUse: Unknown.
• A vendor-published IOC set. The indicators above come from affected administrators on the Nextcloud forum, not from a formal vendor or researcher write-up. They are plausible and consistent, but hold them loosely.

We will update this post as primary sources add detail.

Patch closes the door — detection tells you if someone already walked in

The shape of this incident is the one defenders lose most often: a public-facing service was exploitable for weeks, the activity left no obvious trace in the application, and the first real evidence was a .php file someone happened to notice. By the time you are running integrity:check-app, the attacker has had since September to stage. Patching to 26.4.303 is necessary and urgent — but patching answers "can they still get in," not "are they already inside."

That second question is a network question, and it is where our AI Traffic Analysis pillar is pointed. A web shell has to talk: the system($_GET[c]) backdoor only earns its keep when the operator reaches back to it, which means outbound sessions from a host that normally only serves documents, callbacks to never-seen destinations, command-and-control beacons that signature-based tooling waves through. Zero Hunt runs a proprietary deep-learning model with four parallel inference heads — suspicious traffic, malware classification, attack-type identification, application fingerprinting — on the appliance GPU at 2.7+ Gbit/s, watching for exactly that while it happens, not in the next morning's SIEM digest. On an on-premise appliance, with no customer data leaving it, that is the witness a compromised web server cannot silence.

And once you have patched, the honest way to close the ticket is to prove it. Zero Hunt's autonomous AI red team can re-run the same proof that an exposed instance accepts the injection — black-box, from the attacker's vantage, with a human approving the exploitation step — and the AI Remediation Advisor re-verifies the fix on your exact build rather than trusting the version number. If you are evaluating continuous validation against automated penetration testing tools, this restart-window bug is a good test case: an annual pentest would have missed the window entirely, and so would any scanner that only checks a banner. See also our write-up of the leaked PHP RCE in php2shell for the same web-shell-after-patch pattern.