Friday 16 October 2026
Morning Edition
ZOTPAPER

News without the noise

ZOTPAPER
Security

Hackers exploit unpatched Collabora flaw to backdoor Nextcloud servers

Attacks began weeks before CVE-2026-110447 was formally published, highlighting growing disclosure delays

By LineZotpaper
Published
Read Time2 min
Threat actors are actively exploiting a critical command execution flaw in the Collabora Online Built-in CODE Server app for Nextcloud, planting PHP webshells and hunting for credentials on affected servers. The vulnerability, tracked as CVE-2026-110447, was under attack for roughly a month before formal disclosure, according to administrator reports.

Attackers are exploiting a critical remote code execution vulnerability in the Collabora Online Built-in CODE Server app (richdocumentscode) for Nextcloud, tracked as CVE-2026-110447. Multiple administrator reports indicate exploitations began in mid-September, about a month before the formal security bulletin, GitHub advisory, and CVE publication.

The flaw affects richdocumentscode versions before 26.4.303 and resides in the app's mechanism for starting the bundled Collabora server. Only the optional built-in CODE server app is vulnerable: standalone Collabora Online servers, Docker and RPM/DEB installations, and Nextcloud All-in-One deployments remain unaffected, according to Collabora.

Exploitation involves sending a malicious request to the app's proxy.php endpoint, triggering OS command injection. A key prerequisite is that the built-in CODE server must be stopped, for example after a restart, upgrade, or crash. No authentication or user interaction is required.

Administrators reported attacks against multiple endpoints dating back to September 10. Attackers planted PHP webshells and used them to search for password databases, password manager artifacts, and cryptocurrency wallets. Some users reported that ransomware operators are also exploiting the flaw, though BleepingComputer could not independently confirm this.

Administrators are advised to upgrade to version 26.4.303 or later, or remove the server app if it is not needed. The vendor warned that simply disabling the app is insufficient. A community warning published October 3 urged immediate updates due to ongoing exploitation, but the lack of a CVE ID made it harder for administrators to pinpoint the issue and implement effective defenses.

The incident highlights a broader trend. Research from cybersecurity firm Second Security found that the median interval between public fixes and CVE publication was 39 days in August, up from 5.1 days in January. The researchers suggest growing volumes of AI-assisted vulnerability discoveries are straining CVE processing and contributing to publication delays.

§

Analysis

Why This Matters

  • Administrators running Nextcloud with the built-in Collabora CODE server face active exploitation with no authentication required, meaning exposure can lead to full server compromise.
  • The attack window before official CVE publication left defenders without a formal identifier to work from, complicating detection and patching efforts.
  • The finding that attackers sought password databases, password manager artifacts, and cryptocurrency wallets indicates credential theft and financial targeting are central goals.

Background

Collabora Online is a widely used document editing and collaboration suite integrated into Nextcloud, a popular open-source cloud storage platform. The built-in CODE server is an optional component that bundles the Collabora server directly with Nextcloud deployments. Earlier this year, researchers such as Second Security have been documenting a widening gap between when open-source fixes are publicly released and when formal CVE identifiers are assigned, which can leave administrators without clear guidance during active attack windows.

Key Perspectives

Collabora and Nextcloud maintainers: Both have released fixes and are urging administrators to upgrade to 26.4.303 or later or remove the app entirely. The vendor has been explicit that disabling the app is not a sufficient mitigation. System administrators: Those affected report difficulty responding effectively because the vulnerability was being exploited without a published CVE or formal bulletin, making it harder to identify the precise issue and deploy defenses. Second Security researchers: They argue the disclosure gap is systemic and worsening, attributing the growing backlog to the rising volume of AI-assisted vulnerability discoveries straining CVE processing capacity. Skeptics: Reports that ransomware operators are exploiting the flaw remain unconfirmed, and it is unclear whether the attacks are the work of one group or multiple, unrelated actors.

What to Watch

  • Whether other Nextcloud deployments running older richdocumentscode versions report additional compromise incidents in the coming weeks.
  • Whether Collabora or Nextcloud issue further guidance extending beyond the current 26.4.303 patch.
  • Whether the median CVE publication delay continues to grow, and whether any coordinated effort emerges to close the gap between fixes and formal disclosure.

Sources

Zotpaper

Written by software from the reporting listed above, scored by an automated standards desk, and published without a person reading it first. If something here is wrong, tell the editor and it will be put right.

How we workSubscribe