Collabora Online Built-in CODE Server OS command injection is under active exploitation (CVE-2026-110447)

What happened

Collabora Online Built-in CODE Server is the richdocumentscode Nextcloud app that bundles the Collabora Online document server inside Nextcloud. In affected releases, proxy.php passes an attacker-influenced value to the operating system command line. The vector assumes the built-in CODE server process is not running; the example given is the period after a restart. A network-based attacker can exploit it without credentials or user interaction to execute commands remotely.

This flaw is under documented exploitation. CISA added it to the Known Exploited Vulnerabilities catalogue on 23 October 2026, with a due date of 26 October 2026. ENISA EUVD records exploitation since 23 October 2026, and CISA's SSVC analysis marks exploitation as active and automatable with total technical impact. The issue is distinct from earlier CODE Server vulnerabilities and does not affect standalone Collabora Online servers.

Who is affected

Organisations running Nextcloud with the Collabora Online - Built-in CODE Server app (richdocumentscode) at any version before 26.4.303 are affected. The vulnerable deployment is the built-in CODE Server option; standalone Collabora Online servers are not affected. The code path is reachable when the built-in CODE server is not running, such as immediately after a restart.

What to do now

1. Confirm whether your Nextcloud instance uses the built-in CODE Server app and check its version.
2. Update to Collabora Online - Built-in CODE Server 26.4.303, the fixed version listed in the CVE record. CISA's KEV due date is 26 October 2026.
3. If you cannot update immediately, restrict network access to the Nextcloud instance and monitor for unexpected command execution. No vendor workaround is listed in the available advisory data.
4. Follow the required action in CISA's KEV entry, including the BOD 26-04 guidance on internet exposure and forensics triage, and discontinue use where mitigations are unavailable.

How to detect it

The CVE record and KEV entry do not list specific indicators of compromise. Where the built-in CODE Server is in use, review access to proxy.php and treat unexpected command execution by the web server process as potentially suspicious, particularly during restarts.

Beyond the patch

Active exploitation changes the urgency from patching alone to confirming that nothing is already present. Managed Detection & Response (MDR) finds the post-exploitation activity that a patched unauthenticated command injection can leave behind, and an Incident Response Retainer shortens response when something is found. If you are unsure whether your Nextcloud deployment is reachable from the internet, Virtual CISO Services (vCISO) can help establish the exposure and prioritise the fix.