VulnSocial

CVE-2026-110447

LOWCVSS 9.2 · CRITICAL

Signal is active with 4 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 4 mentions across 1 observed day

What's happening

  • 4 total mentions across 1 day

Deep dive

Activity timeline4 mentions / 1d
01234Mentions · 2026-10-14: 410-14
Referenced assets3 URLs
Full discourse4 posts
  • ThreatWire@ThreatWire_

    🔥 EXPLOITED IN THE WILD — Nextcloud CVE-2026-110447 CVSS 4.0: 9.2 Critical (MITRE) Unauthenticated OS command injection in the Nextcloud "Collabora Online - Built-in CODE Server" app (richdocumentscode), via proxy.php. 🎯 Attackers are dropping PHP webshells on unpatched servers (Sep–Oct 2026), per the CVE record and reports on Collabora's GitHub. ✅ Fixed in 26.4.303 (Sep 11) Standalone Collabora / Docker: not affected What to do: • Update the app now • Look for unexpected shx*.php files • If found, treat the server as compromised Not in CISA KEV yet. Full breakdown 👇 https://www.threatwire.tech/threats/nextcloud-richdocumentscode-proxy-rce-is-cve-2026-110447 #Nextcloud #Collabora #CVE #RCE #Webshell #CyberSecurity #Infosec

    0301871.2K
    1.8K followersView on X
  • International Cyber Digest@IntCyberDigest

    ‼️BREAKING: Hackers are planting webshells on Nextcloud servers through a critical Collabora flaw. CVE-2026-110447 in the built-in CODE Server app lets anyone run commands without logging in. Collabora says update to 26.4.303 or delete it. https://t.co/DBchqAZC9w

    1601542.6K
    240.0K followersView on X
  • Daily CyberSecurity@Daily_CyberSec

    Attackers are actively exploiting CVE-2026-110447 (CVSS 9.2), a critical Nextcloud Collabora Online RCE flaw in richdocumentscode, to deploy PHP webshells. #CVE2026110447 #Nextcloud #CollaboraOnline #RCE #Webshell #Cybersecurity #InfoSec #354 https://securityonline.info/nextcloud-collabora-online-cve-2026-110447-exploited/

    100143747
    13.0K followersView on X
  • SecNews@SecNews_GR

    CVE-2026-110447: Ενεργές επιθέσεις μέσω του Collabora CODE https://www.secnews.gr/740244/cve-2026-110447-collabora-code-nextcloud/?fsp_sid=18767

    0000078
    7.0K followersView on X

Explore more

Back to dashboard