Nextcloud Collabora Vulnerability Exploited

Nextcloud Collabora Built-in CODE Server vulnerability CVE-2026-110447 exploited to plant web shells, October 2026

A Nextcloud Collabora vulnerability in the optional Built-in CODE Server app has let attackers plant web shells on Nextcloud servers since September 10. Collabora fixed it on September 11 without a security notice, and the CVE (CVE-2026-110447) followed only on October 14. Disabling the app does not close the hole: update it or remove it.…

Read More