CVE-2026-110447 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-10-14

Added to CISA KEV: 2026-10-23 9 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL — ACTIVE EXPLOITATION: Immediately check all Nextcloud instances with richdocumentscode installed for indicators of compromise. Look for unauthorized web shells (unusual PHP files in Nextcloud directories), unexpected outbound connections, new cron jobs, or modified system files. Review web server access logs for anomalous requests to proxy.php with command injection patterns.
PATCH IMMEDIATELY: Update Collabora Online Built-in CODE Server (richdocumentscode) to version 26.4.303 or later via the Nextcloud App Store or manual update. This is the only effective remediation.
TEMPORARY MITIGATION (if patching is not immediately possible): Restrict access to the Nextcloud instance via firewall rules, IP allowlisting, or placing it behind a VPN/reverse proxy with authentication. Consider temporarily disabling the richdocumentscode app until patching is complete.
POST-INCIDENT: If compromise is suspected, assume the host system is fully compromised (attacker had OS-level command execution as the web server user). Conduct full forensic investigation, rotate all credentials stored on or accessible from the server, and consider rebuilding the host from a known-good baseline.
MONITORING: Deploy WAF rules to detect command injection attempts against proxy.php. Monitor for unusual child processes spawned by the web server process (e.g., bash, sh, curl, wget launched by Apache/nginx/PHP-FPM).
PATCH PRIORITY: CRITICAL — treat as P0/emergency patch due to confirmed active exploitation, unauthenticated RCE, and widespread internet-facing deployment of affected software.

🔍 Web Intelligence (Kagi · 2026-10-23)

Summary

CVE-2026-110447 is a critical OS command injection vulnerability (CWE-78) located in the `proxy.php` component of the Collabora Online Built-in CODE Server (`richdocumentscode`), which is an application used within Nextcloud environments. The vulnerability is triggered specifically when the local CODE server is not running—such as immediately following a product restart—allowing an unauthenticated attacker to inject and execute arbitrary operating system commands. This flaw is highly significant because it enables remote code execution (RCE) on the host system, granting attackers the ability to compromise the integrity and confidentiality of the entire Nextcloud instance.

Exploitation

Active Exploitation: The vulnerability has been actively exploited in the wild during September and October 2026.
Threat Actors/Campaigns: Attackers have utilized this vulnerability to gain unauthorized access, including the planting of web shells on affected systems.
Proof-of-Concept/Exploit: While specific exploit tool availability is widely documented as having been used by threat actors in the wild, the vulnerability is known to be reachable by remote, unauthenticated attackers.
Prerequisites: The attack is network-based and does not require authentication or user interaction, provided the targeted CODE server is in a down or restarting state.

Affected Products & Patches

Affected Product: Collabora Online Built-in CODE Server (`richdocumentscode`) for Nextcloud.
Affected Versions: All versions prior to 26.4.303.
Patch Availability: The vendor has released a patch; users are strongly advised to update to version 26.4.303 or later.
Mitigations: If patching is not immediately feasible, ensure the Collabora Online Built-in CODE Server is properly maintained in a running state, though upgrading is the only effective resolution.

Impact

Access/Capability: Successful exploitation grants an attacker the ability to execute arbitrary commands with the privileges of the web server user, typically resulting in full remote code execution.
Business Risk: For internet-facing Nextcloud deployments, this represents a critical risk, as it allows attackers to completely compromise the application, potentially leading to unauthorized data exfiltration, lateral movement within the network, and the deployment of persistent threats like web shells.