Critical Vulnerability Found in Nextcloud Document Editing Plugin
CVE-2026-110447 allows complete server takeover.
A critical vulnerability (CVE-2026-110447) in the document editing plugin of Nextcloud, a self-hosted cloud platform, has been identified.
The flaw, rated CVSS 9.2, enables attackers to take over servers without needing login credentials.
U.S. CISA warns users to update to version 26.4.303 or higher immediately to mitigate the risk.