Attackers are exploiting a critical Collabora vulnerability to compromise Nextcloud servers, according to an October 15 report by BleepingComputer. Tracked as CVE-2026-110447, the flaw affects the optional Collabora Online - Built-in CODE Server app. Administrators have reported PHP web shells on affected systems, while the number of compromised installations remains unclear.

The MITRE CVE record confirms exploitation during September and October 2026. BleepingComputer reports that version 26.4.303 was released on September 11, more than four weeks before the October 14 advisory and CVE publication. An October 3 Nextcloud community warning had already urged users to update after reports of web shells.

According to Collabora, a request to the richdocumentscode app's proxy.php endpoint can execute operating system commands under the web server account. Exploitation requires the bundled CODE server to be stopped, which can occur during a restart, upgrade or crash. The advisory rates the flaw critical at 9.2 under CVSS 4.0, with no authentication or user interaction required.

The vendor identifies versions before 26.4.303 as affected and says standalone Collabora Online servers are outside the vulnerable deployment. It also distinguishes this command-injection path from CVE-2025-66208: the fix for that earlier issue does not prevent exploitation of the newly documented flaw.

BleepingComputer reports that administrators found attackers using web shells to search for password databases, password manager artifacts and cryptocurrency wallets. Nextcloud told the publication it had not observed widespread exploitation. These reports establish a risk to sensitive information on compromised hosts without establishing a total victim count or confirming that every targeted file was stolen.

Collabora directs administrators to upgrade the built-in app to version 26.4.303 or later, or remove it. Simply disabling the app does not eliminate the vulnerability. For users of end-of-life Nextcloud versions 29 and earlier, the vendor recommends upgrading Nextcloud or removing the app, making deployment and version checks central to remediation.