Many small and mid-size businesses run their own Nextcloud server for file sharing, and many of those use an add-on app called Collabora Online - Built-in CODE Server to edit documents in the browser. A critical flaw in that app, tracked as CVE-2026-110447, lets an attacker run commands on the server without logging in. It is rated 9.2 out of 10 for severity, and it is already being used in real attacks.
On October 23, 2026, CISA added the flaw to its list of known exploited vulnerabilities, the list it keeps of security holes attackers are actively using. The fix is an app update that is already available.
The short version: if your Nextcloud has the Built-in CODE Server app installed, update it to version 26.4.303 or later, or remove it. Simply disabling it is not enough. Then have someone check the server for signs it was broken into.
What the flaw is
The built-in app starts its own small document server behind Nextcloud. According to Collabora's security advisory, a specially crafted web request to the app can make the server run an operating system command as the web server user. The attack only works while that document server is not running, which happens normally after a restart, an upgrade or a crash. No password is needed.
The U.S. National Vulnerability Database notes that the flaw was exploited in the wild in September and October 2026. On Nextcloud's community forum, administrators have reported finding web shells, which are hidden files attackers leave behind to keep control of a server.
Who is at risk
- Affected: self-hosted Nextcloud servers with the Collabora Online - Built-in CODE Server app (its technical name is richdocumentscode) at any version before 26.4.303.
- Not affected: standalone Collabora Online servers, according to Collabora. If your documents open through a separate Collabora server rather than the built-in app, this particular flaw does not apply.
- Older Nextcloud: Collabora says users of Nextcloud 29 or older, which no longer gets updates, should upgrade Nextcloud or remove the app.
What to do
- In Nextcloud, open the Apps page and check whether Collabora Online - Built-in CODE Server is installed, and which version.
- Update it to 26.4.303 or later. If you no longer need it, remove it completely. Collabora states that disabling the app does not protect you.
- If you run Nextcloud 29 or older, plan the Nextcloud upgrade now, or remove the app until you can.
- Because attacks started before many people knew about the flaw, have your IT provider review the server: look for unfamiliar PHP files in the Nextcloud folders and for unusual requests to the app in the web server logs going back to early September.
- If anything suspicious turns up, treat the server as compromised: change the passwords and keys stored in Nextcloud's configuration, and review who has had access to your files.
Questions to ask this week
- Do we run our own Nextcloud server, and does it use the built-in office app?
- Has the app been updated to 26.4.303 or later, or removed?
- What version of Nextcloud are we on, and is it still supported?
- Has anyone checked the server for signs of a break-in since September?
Sources
Not sure whether your Nextcloud server uses the built-in office app, or whether it was touched? We can check the version, apply the update and look for signs of compromise. Call 713.980.2000 or send us a note.
Let's Talk →