CISA Cracks Down on Nextcloud: Three Days to Close CVE-2026-110447

On October 23, 2026, CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog, giving federal agencies until October 26 to remediate the critical command injection flaw in Nextcloud's richdocumentscode module.

On October 23, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-110447 to its Known Exploited Vulnerabilities (KEV) catalog, setting a federal remediation deadline of October 26, 2026. The vulnerability affects the optional Collabora Online Built-in CODE Server (Nextcloud app richdocumentscode): an unauthenticated OS command injection, exploitable when the CODE server is not running, allows remote code execution with the web server user's privileges.

Key Takeaways

The CVSS 4.0 score is 9.2 (Critical) per the official CVE record, with a network attack vector and low complexity.
Patch 26.4.303 was released on September 11, 2026, but the official advisory (GHSA-g3vx-3m76-fghh) did not publish until October 14, a gap of over a month.
Disabling the application does not eliminate the risk: updating to ≥26.4.303 or completely removing the module is required.
Confirmed attacks date back to September 10, 2026, with web shell deployment and credential theft from configuration files.

The Flaw in the proxy.php Module

The technical core resides in the proxy.php file of the richdocumentscode app, which handles proxying requests to the integrated Collabora server. According to advisory GHSA-g3vx-3m76-fghh published by Collabora on October 14, 2026, the OS command injection triggers in a transient condition: when the built-in CODE server is not running. This transient state occurs during container restarts, upgrades, or following a crash.

The official CVE record, classified as CWE-78, describes the vulnerability as "OS command injection in proxy.php when the CODE server isn't running." The documented CVSS 4.0 vector is AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N: network attack, low complexity, partial attack time, no privileges required, no user interaction, maximum impact on confidentiality, integrity, and availability.

Commands execute with the web server user's identity, not as root. This limitation does not prevent, as documented in confirmed incidents, the installation of PHP web shells in the apps/richdocumentscode directory and exfiltration of configuration files containing credentials.

The Illusion of Quick Mitigation

A sharp technical-administrative friction point emerges from Collabora's advisory: disabling the app does not constitute remediation. The source states verbatim: "It is not sufficient to disable the app to avoid the problem, it must be upgraded to >= 26.4.303 or removed". This characteristic stems from the nature of the proxy.php file, which remains reachable via HTTP even with the app disabled if the filesystem is not modified.

The impact matrix complicates further for installations on End-of-Life Nextcloud versions. Release 26.4.303 requires Nextcloud 30 or later. For instances on Nextcloud 29 or earlier — where the maximum available is 26.4.104 — updating the module is technically impossible. Collabora explicitly stated that users of these platforms must "upgrade their Nextcloud or remove this app".

Standalone Collabora servers, Docker images, RPM/DEB packages, and the Nextcloud All-in-One instance are not affected, as confirmed by both the vendor advisory and the CVE record.

The Timeline Exposing the Exposure Window

The chronological sequence reveals a critical interval of reduced visibility for administrators. Fix 26.4.303 was released on September 11, 2026, but CVE assignment and advisory publication slipped to October 14. Meanwhile, administrator logs document active exploitation as early as September 10-11, with reports on GitHub issue #354 describing PHP web shells found in the module directory.

The first reporter on the issue noted that "anything the web server account could read must be treated as potentially affected", indicating the need for extended forensic triage beyond simple payload removal.

ACN (CSIRT Italy) confirmed a compromise on national territory involving three web shells and theft of a configuration file containing credentials. CERT Polska reported the vulnerability is actively used for ransomware attacks and server takeover, although the Known to be Used in Ransomware Campaigns? field in the CISA catalog reads "Unknown" at the time of KEV inclusion.

CISA issued the KEV alert on October 23, 2026, citing Binding Operational Directive 26-04 (BOD 26-04), which requires federal agencies to complete remediation by the end of the weekend: three full days from catalog inclusion.

"The attack only works while the built-in CODE server is not running. So on a container restart, an upgrade, or after a crash." — Collabora GHSA-g3vx-3m76-fghh

What to Do Now

Verify presence of the module richdocumentscode: only Nextcloud instances with this app installed are exposed; servers without the built-in module require no action on this CVE.
Update to 26.4.303 or later if using Nextcloud 30+; for earlier versions, plan the platform upgrade or complete module removal from the filesystem, not just deactivation.
Conduct forensic triage on instances that had the module active during the September-October 2026 period: CISA explicitly requires forensic triage: Yes in the KEV catalog field.
Hunt for web shells and rotate credentials on compromised installations: simply applying the patch does not remove persistent access or already exfiltrated data.

The Lesson of the Advisory-Patch Gap

CVE-2026-110447 illustrates a recurring dynamic in the enterprise open-source ecosystem: publishing the fixed code does not automatically equate to risk awareness. For over a month, between September 11 and October 14, 2026, the fix was available in repositories but not labeled as security-critical, leaving administrators without the tools to assess update priority.

The acceleration imposed by CISA — three days from KEV to federal deadline — contrasts with that opacity phase. For organizations not subject to BOD 26-04, the October 26 deadline serves as a market signal: exploitation is confirmed, the mechanism is documented, and the attack surface, though conditioned on the CODE server state, is sufficiently reproducible to be automated.

Frequently Asked Questions

Is my Nextcloud vulnerable if I don't use Collabora?: No. The vulnerability is confined to the optional richdocumentscode module. Standalone Collabora servers, Docker, or Nextcloud All-in-One are not affected.
I disabled the app: am I protected?: No. Per the official Collabora advisory, disabling does not prevent access to proxy.php: updating to 26.4.303+ or complete removal from the filesystem is required.
Can I update just the module if I have Nextcloud 29?: No. Version 26.4.303 requires Nextcloud 30+. On release 29 and earlier, the maximum available is 26.4.104, which does not include the fix. You must upgrade the Nextcloud platform or remove the module.

Sources

Sources and references

Get DeafLetter