CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities (KEV) catalog on 23 October 2026. The flaw sits in the Built-in CODE Server app for Nextcloud, also called richdocumentscode. A request to the app can run a system command on the server, with no login, while the app’s built-in server is not running. Attacks were logged from 10 September, a month before the CVE was published. The fix is app version 26.4.303 or later. Work through the five steps below in this order.
- Find your instancesEvery Nextcloud that has the Collabora Online – Built-in CODE Server app installed.
- Read the app versionAnything older than 26.4.303 is vulnerable.
- Update or remove the appCopy the app folder and logs first. Disabling it does not help.
- Hunt before you cleanLook for web shells and log lines back to 10 September.
- Verify and rotateRe-check the version, then replace secrets if you found a hit.
Step 1: Find Your Instances
The flaw affects the optional Built-in CODE Server app inside Nextcloud. Standalone Collabora Online servers are not affected, says Collabora. Its 15 October blog post adds that Docker images, RPM and DEB packages and Nextcloud All-in-One images are not affected. It calls the scope narrow.
Narrow still leaves many servers. Censys, an internet scanning firm, counted 19,454 hosts with the app installed on 16 October.
“not all confirmed vulnerable”, @censysio, 16 October. Censys counted 19,454 hosts and 103,350 web properties with the app installed.
Step 2: Read the App Version
Open the Nextcloud apps list and read the version of Collabora Online – Built-in CODE Server. Collabora’s advisory lists versions before 26.4.303 as vulnerable. A community member on the Nextcloud forum names 26.4.302 and older.
Nextcloud 29 and older need a closer look. The advisory tells these users to upgrade Nextcloud or remove the app. The app store lists no build at or above 26.4.303 for these releases.
Step 3: Update or Remove the App, Never Just Disable It
Before you update or remove the app, copy the apps/richdocumentscode/ folder and your web server logs. CISA’s forensic triage guidance says to collect evidence before you change a system when you can, because patching may destroy artifacts.
Update to 26.4.303 or later. The app store listed 26.4.502 for Nextcloud 30 and later on 23 October. If you do not use the built-in server, remove the app. Collabora’s advisory says that turning the app off is not enough.
The urgency is real. The NVD record says the flaw was exploited in the wild in September and October 2026. CISA set 26 October as the due date for US federal agencies and records known ransomware use as unknown. Italy’s national CSIRT reported active exploitation on 16 October.
“active exploitation detected” (our translation), @csirt_it, 16 October. The CSIRT flagged web shell installation and credential theft, and advised updating and checking for compromise.
A public script followed the disclosure. A GitHub repository created on 14 October holds code that calls itself a lab proof of concept and says it refuses non-local targets unless told otherwise. A second repository, created on 23 October, is a read-only triage toolkit that lists this id with the PHP2Shell flaws. This flaw sits in a Nextcloud app, not in PHP. We read both. We did not run or link them.
Sellers have noticed too. On 16 October a Telegram channel advertised a tool for this flaw for 40 USDT, a dollar-pegged cryptocurrency, with a free list of 10,000 targets. On 20 October another channel offered a script it said could scan target lists and drop a web shell. We found both through our THANOS dark web search and have not verified either claim.
Step 4: Hunt for Web Shells Before You Clean Up
Updating the app does not remove a web shell that an attacker already planted. Admins who reported attacks in the Collabora issue found PHP files they did not create. CISA marked this entry for forensic triage under its BOD 26-04 directive, and its guidance says to collect evidence before you change a system when you can. Copy any file you find before you delete it.
- Look inside
apps/richdocumentscode/for PHP files you did not install. In the GitHub issue, reporters named files that start withshxorshrf. In the Nextcloud forum, an integrity scan flagged another name,Nx_33143.php, so check every PHP file you did not install. - Search web server logs back to 10 September for requests to
proxy.phpthat contain$(,${IFS}or the encoded%24%28in the path. - Check Nextcloud’s own integrity scan. After an update it flagged an extra PHP file in the app folder for one admin in the forum thread.
Our Web Shell technique (T1505.003) page explains how this kind of persistence works and what defenders look for.
Step 5: Verify the Fix and Rotate Secrets
Re-open the apps list and confirm the new version. Run the file and log checks again after the update. Treat a hit as a full compromise. The commands ran as the web server user, so assume that any secret in a file it can read is exposed. That includes the Nextcloud configuration file. Consider a standalone Collabora server for the long run. Collabora says it is not affected, and its blog says the built-in app is not its recommended setup.
Why Does the Order Matter?
Because attackers moved before the advisory did. The first logged attack in the GitHub issue dates to 10 September. An admin who hosts several Nextcloud servers opened the issue on 11 September, the day version 26.4.303 was released. A maintainer told users to upgrade on 14 September. A community member warned on the Nextcloud forum on 3 October that users had found web shells.
The advisory and the CVE appeared on 14 October. Collabora blames the delay on GitHub’s CVE backlog and says it plans to become a CVE numbering authority. CISA listed the flaw nine days later. A server patched in September may still hold a shell from before the fix, which is why step 4 comes before step 5. Our CVE-2026-110447 vulnerability page keeps the fixed version, the timeline and the sources in one place. CISA also added the Plex flaws behind our Plex2Shell analysis and the VeloCloud Orchestrator flaw (CVE-2026-114625) to the catalog this week, two other cases to review.