Nextcloud's Collabora Online Vulnerability Prompted CISA Action
A vulnerability in Nextcloud's integrated Collabora Online application has been exploited by attackers, prompting a directive from the U.S. CISA to patch systems.
A critical vulnerability (CVE-2026-110447) in the Collabora Online CODE Server component of Nextcloud allows attackers to execute commands on the server if it is temporarily stopped, as detailed in a recent report. CISA has classified the vulnerability as high severity (9.2/10) and ordered federal agencies to remediate it by October 26th.
The flaw resides in the proxy.php file, which improperly handles user input, enabling command injection when the server is offline. This allows unauthorized individuals to execute commands with the web server’s permissions, potentially leading to backdoors and credential theft.
Nextcloud users are advised to update to version 26.4.303 or later, delete any residual files starting with ‘shx’ and ending in ‘.php’, and review server configurations for compromised credentials. Several administrators have already reported successful attacks and credential harvesting attempts beginning in September.