actively-exploited-vulnerabilitygovernment-vulnerability-cataloginternet-facing-service-vulnerabilitypersistence-method

CISA Adds Exploited Nextcloud Collabora CODE Server RCE Flaw to KEV Catalog

Active Exploitation · 3 sources · Updated 10d ago · First seen Oct 24, 2026

CISA added CVE-2026-110447, a critical OS command injection vulnerability in Nextcloud’s Collabora Online Built-in CODE Server app (richdocumentscode), to its Known Exploited Vulnerabilities catalog on October 23. The flaw affects versions before 26.4.303 and allows unauthenticated attackers to execute commands as the web server user through proxy.php when the local CODE server is not running, including after a restart. It carries a CVSS v4.0 score of 9.2; standalone Collabora Online servers are unaffected.

Exploitation was reported during September and October, including PHP web shell deployment and searches for credentials and cryptocurrency wallets. The number of compromised servers remains unknown, and CISA lists ransomware campaign use as unknown. Federal civilian executive branch agencies must remediate by October 26, 2026, with forensic triage also required. Organizations should upgrade to version 26.4.303 or later, investigate potentially exposed systems for compromise, and discontinue use if vendor mitigations cannot be applied.

This is being exploited nowSee which actors are running it and whether you're in range.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

7 events · Sep 10, 2026 – Oct 23, 2026

Reported Oct 24, 202610d ago
Project maintainer urges updates and removal of leftover PHP files
Project maintainer mmeeks urged users to update the Built-in CODE Server app and remove leftover shx*.php files associated with the reported compromises.
U.S. CISA adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog
Reported Oct 24, 202610d ago
Two additional administrators report similar compromises
Two additional administrators reported similar exploitation incidents on GitHub, bringing the reported administrator accounts to three. None of the three found evidence of root access.
U.S. CISA adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog
Reported Oct 24, 202610d ago
Collabora fixes the command injection vulnerability in version 26.4.303
Built-in CODE Server version 26.4.303 fixes the unauthenticated OS command injection vulnerability in proxy.php. The flaw affects the Nextcloud app deployment, not standalone Collabora Online servers.
U.S. CISA adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog
Oct 23, 202612d ago
CISA adds CVE-2026-110447 to its Known Exploited Vulnerabilities catalog
CISA added the vulnerability to its KEV catalog, requiring forensic triage and vendor-directed mitigation by October 26, 2026. The entry lists use in ransomware campaigns as unknown.
Add Updated KEV Files for 2026-10-23 · cisagov/kev-data@b9c486e · GitHub
Oct 14, 202621d ago
CVE record published for actively exploited Collabora vulnerability
The CVE-2026-110447 record was published on October 14, assigning a critical CVSS v4.0 score of 9.2 and confirming exploitation during September and October 2026. Exploitation permits remote command execution when the local CODE server is not running.
CVE Record: CVE-2026-110447
Sep 14, 20262mo ago
Administrator observes another attack attempt after updating
An administrator observed another exploitation attempt on September 14 after updating to version 26.4.303. No new web shell appeared following the attempt.
U.S. CISA adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog
Sep 10, 20262mo ago
Attackers exploit Nextcloud's Built-in CODE Server and deploy a web shell
An administrator's logs showed malicious requests against proxy.php on September 10 and 11, targeting version 26.4.302. Attackers deployed a PHP web shell and searched a compromised server for credential stores and cryptocurrency wallets.
U.S. CISA adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Unauthenticated command injection in Collabora Online Built-in CODE Server for Nextcloud (CVE-2026-110447)

Affected products

1 linked

Collabora Online Built-In Code Server

Organizations

1 linked

Cybersecurity and Infrastructure Security Agency

Do you run this?Correlate live exploitation activity against the software you actually run, and see where you're exposed.

See Who's Exploiting This

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Security AffairsNews · Oct 24, 2026

U.S. CISA adds Collabora Online flaw to its Known Exploited Vulnerabilities catalogOpen source ↗

Cisa Kev Data CommitsAdvisories · Oct 23, 2026

Add Updated KEV Files for 2026-10-23 · cisagov/kev-data@b9c486e · GitHubOpen source ↗

CveAdvisories · Oct 14, 2026

CVE Record: CVE-2026-110447Open source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

actively-exploited-vulnerabilitygovernment-vulnerability-cataloginternet-facing-service-vulnerabilitypersistence-method

CISA Adds Exploited Nextcloud Collabora CODE Server RCE Flaw to KEV Catalog

Active Exploitation · 3 sources · Updated 10d ago · First seen Oct 24, 2026

This is being exploited nowSee which actors are running it and whether you're in range.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

7 events · Sep 10, 2026 – Oct 23, 2026

Reported Oct 24, 202610d ago
Project maintainer urges updates and removal of leftover PHP files
Project maintainer mmeeks urged users to update the Built-in CODE Server app and remove leftover shx*.php files associated with the reported compromises.
U.S. CISA adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog
Reported Oct 24, 202610d ago
Two additional administrators report similar compromises
Two additional administrators reported similar exploitation incidents on GitHub, bringing the reported administrator accounts to three. None of the three found evidence of root access.
U.S. CISA adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog
Reported Oct 24, 202610d ago
Collabora fixes the command injection vulnerability in version 26.4.303
Built-in CODE Server version 26.4.303 fixes the unauthenticated OS command injection vulnerability in proxy.php. The flaw affects the Nextcloud app deployment, not standalone Collabora Online servers.
U.S. CISA adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog
Oct 23, 202612d ago
CISA adds CVE-2026-110447 to its Known Exploited Vulnerabilities catalog
CISA added the vulnerability to its KEV catalog, requiring forensic triage and vendor-directed mitigation by October 26, 2026. The entry lists use in ransomware campaigns as unknown.
Add Updated KEV Files for 2026-10-23 · cisagov/kev-data@b9c486e · GitHub
Oct 14, 202621d ago
CVE record published for actively exploited Collabora vulnerability
The CVE-2026-110447 record was published on October 14, assigning a critical CVSS v4.0 score of 9.2 and confirming exploitation during September and October 2026. Exploitation permits remote command execution when the local CODE server is not running.
CVE Record: CVE-2026-110447
Sep 14, 20262mo ago
Administrator observes another attack attempt after updating
An administrator observed another exploitation attempt on September 14 after updating to version 26.4.303. No new web shell appeared following the attempt.
U.S. CISA adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog
Sep 10, 20262mo ago
Attackers exploit Nextcloud's Built-in CODE Server and deploy a web shell
An administrator's logs showed malicious requests against proxy.php on September 10 and 11, targeting version 26.4.302. Attackers deployed a PHP web shell and searched a compromised server for credential stores and cryptocurrency wallets.
U.S. CISA adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog

Linked entities