Nextcloud, Collabora CODE: CVE-2026-110447 added to CISA KEV

On 14 October ARX News covered CVE-2026-110447, the OS command injection in the Collabora Online – Built-in CODE Server app (richdocumentscode) for Nextcloud, exploited to plant PHP web shells. On 23 October 2026 CISA added it to the Known Exploited Vulnerabilities (KEV) catalogue, which lists the vulnerabilities for which the agency has evidence of active exploitation. The NVD record was updated the same day. What follows is what is new compared with the first article.

What changes with the KEV listing

In the first article, exploitation was documented by the CERT.LV advisory and by administrators’ reports gathered by the specialist press. Now CISA also considers the vulnerability exploited.

The KEV entry is titled “Collabora Online – Built-in CODE Server OS Command Injection Vulnerability” and asks organisations to:

• apply mitigations according to the vendor’s instructions, following CISA’s BOD 26-04 directive on prioritising updates by risk and its “Forensics Triage Requirements”;
• for cloud services, follow the same directive or stop using the product if mitigations are unavailable;
• assess the internet exposure of every system.

For US federal agencies the deadline is 26 October 2026, three days after the listing. The deadline does not apply to European companies, but it shows the priority CISA gives to the vulnerability.

The entry does not describe the attacks: it names no victims, actors or indicators of compromise. Under known use in ransomware campaigns it says “Unknown”. What some users had written about ransomware groups exploiting the flaw therefore remains unconfirmed, as the first article already pointed out.

The details in the NVD record

The NVD record for CVE-2026-110447, published on 14 October and last modified on the 23rd, has the status “Deferred”: NVD has postponed its own analysis and has not assigned its own score. The score provided by MITRE stands, CVSS 4.0 9.2 (critical), with vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. That means: network attack, low complexity, no privileges and no user interaction; high impact on the confidentiality, integrity and availability of the vulnerable system, no impact stated on subsequent systems. The AT:P value (attack requirements present) is consistent with the known condition: the built-in CODE server must not be running. The weakness is classified as CWE-78 (OS command injection).

The NVD description adds three points:

• exploitation took place in September and October 2026, so also after the fixed version was released on 11 September;
• the vulnerability is different from CVE-2025-66208: they are two separate identifiers;
• the flaw is in proxy.php and occurs when the CODE server is not running, for example right after the product has been restarted; standalone Collabora Online servers are not affected, only this deployment with the built-in CODE Server.

The fixed version given by NVD matches the one in the first article: 26.4.303; all earlier versions are vulnerable.

Among its references, besides the KEV entry, NVD links issue no. 354 in the CollaboraOnline/richdocumentscode GitHub repository and the Nextcloud forum thread titled “To Collabora built-in user: update ASAP”.

Impact for European and Italian companies

With the KEV listing, the vulnerability enters the priority lists of everyone who follows CISA’s catalogue. The first article noted that, without a CVE identifier, the flaw had gone unnoticed for weeks by scanners and vulnerability management processes: it now has a CVE, a score and confirmation of exploitation from a government agency. Since exploitation continued in October, anyone who has not yet updated should treat a compromise as possible.

For entities in scope of NIS2, what was written before still applies: handling exploited vulnerabilities is part of the required security measures, and a compromise must be assessed for notification to CSIRT Italia at ACN (or your national CSIRT). If the server holds personal data, including health data in healthcare, the GDPR obligations on data breaches also apply.

What to do now

1. Check whether you use the richdocumentscode app on every Nextcloud instance, including test ones. Installations with a separate Collabora Online server are not affected.

2. Update to 26.4.303 or later. If you do not need the app, remove it: as reported in the first article, the vendor warns that disabling it is not enough.

3. Do not mix up the CVEs: if CVE-2025-66208 shows up in your tools, handle it separately; CVE-2026-110447 is a different vulnerability.

4. Carry out forensic triage, as CISA also asks, covering the whole period from September to today:

   • requests to the app’s proxy.php in the web server logs, especially after restarts and updates;
   • PHP files that do not belong to Nextcloud, also using occ integrity:check-core and occ integrity:check-app;
   • unusual processes and outbound connections of the web server user.

   Updating does not remove a web shell that is already in place.

5. If you find traces: isolate the server, change the credentials in config.php and the secrets stored on the server, then assess your notification obligations.

How ARXDOME helps

ARX Shield lists the open vulnerabilities on monitored machines, highlighting those already exploited, and lets you isolate a suspicious machine from the network. On computers and servers with the ARXDOME agent, ARX Sentry checks file integrity in the chosen folders: if you include the Nextcloud folders, new PHP files appearing there become an event to analyse. ARX Expose shows which of your company’s services are visible from the internet.

Last updated: 23 October 2026