Collabora RCE Flaw Exploited to Backdoor Nextcloud Servers
Threat actors are exploiting a critical remote code execution vulnerability affecting the built-in Collabora Online server app in Nextcloud, leading to the deployment of malicious webshells and targeted searches for sensitive data.
Radwan AbdulhadiEditor and technology writer
Overview of the Critical Vulnerability
Threat actors are actively exploiting a critical command execution flaw tracked as CVE-2026-110447 in the Collabora Online - Built-in CODE Server app, known as richdocumentscode, for Nextcloud. According to a detailed report published by BleepingComputer, multiple administrator reports indicate that attacks began in mid-September, roughly a month before the official security bulletin, GitHub advisory, and subsequent CVE publication.
The vulnerability impacts richdocumentscode versions prior to 26.4.303. The security issue itself resides within the Nextcloud application's mechanism for starting the bundled Collabora server. However, Collabora has clarified that the flaw affects only the optional built-in CODE server app. Standalone Collabora Online servers, Docker installations, RPM and DEB packages, and Nextcloud All-in-One deployments remain completely unaffected.
Exploitation Mechanism and Prerequisites
The attacks involve sending a malicious request directly to the application's proxy.php endpoint, which subsequently triggers operating system command injection. A key prerequisite for successful exploitation is that the built-in CODE server must be in a stopped state—such as following a system restart, upgrade, or crash. Notably, successful exploitation requires neither user interaction nor any form of authentication.
System administrators impacted by malicious activity have reported attacks targeting multiple endpoints dating as far back as September 10. According to these incident reports, attackers planted PHP webshells on compromised systems and leveraged them to search for password databases, password manager artifacts, and cryptocurrency wallets.
In addition to unauthorized access and data reconnaissance, some users reported that ransomware operators are exploiting the flaw, though BleepingComputer could not independently confirm these specific claims regarding ransomware deployment.
Mitigation and Administrator Guidance
System administrators are strongly recommended to upgrade the affected application to version 26.4.303 or later, or alternatively remove the server app entirely if it is not required. The vendor explicitly warned that simply disabling the app is insufficient to mitigate the security risk.
Beyond mid-September warnings issued by maintainers, a community warning was published on October 3, urging administrators to update immediately due to ongoing exploitation in the wild. However, the initial absence of a CVE ID made it significantly more difficult for administrators to accurately pinpoint the issue and implement efficient security defenses across their environments.
Disclosure Gaps and AI-Driven Vulnerability Trends
A study from cybersecurity firm Second Security illustrates the widening gap between the deployment of security fixes and formal vulnerability notifications. The firm analyzed real-world examples from open-source flaws and found that the median interval between public fixes and CVE publication reached 39 days in August, up significantly from 5.1 days in January.
The researchers suggest that a growing volume of AI-assisted vulnerability discoveries is straining standard CVE processing mechanisms and contributing to notable publication delays. In many cases, the researchers observed that public exploit code emerged online within hours of a security fix being committed and several days before the corresponding CVE was formally published. Second Security notes that the use of AI tools makes it remarkably easy for attackers to generate working exploits for published fixes.
In the case of Collabora, the security fix was committed on September 9, and version 26.4.303 was subsequently released on September 11. The official advisory and CVE publication did not occur until October 14, marking a gap of more than four weeks.
Vendor Responses and Explanations
Nextcloud informed BleepingComputer that Collabora reported the vulnerability in mid-September and that an update promptly became available through the app store. The company justified the disclosure delay by stating that it gave users adequate time to update and that it had not observed widespread exploitation at the time.
In a blog post published about the activity, Collabora attributed the delayed announcement primarily to GitHub CVE-processing backlogs. The vendor stated that these backlogs were currently under severe strain driven by increasing volumes of AI-driven security reports.
Sources
- BleepingComputerHackers exploit Collabora RCE flaw to backdoor Nextcloud servers
Continue chronologically
Related entity coverage
Related stories
Denmark Ends Microsoft Office Open-Source Pilot Project
Denmark's digitization ministry has concluded its short-lived experiment to replace Microsoft Office with the open-source Collabora suite after under six months.
GitLab Warns of Max Severity Code Execution Flaw
GitLab has released urgent security patches for a maximum-severity integer overflow vulnerability in its Regular Expression Compiler engine.
Hackers Exploit SiteGuard WAF Flaw for Root Access
Hackers are actively exploiting a critical OS command injection vulnerability in SiteGuard Server Edition to run commands with root or SYSTEM privileges.
Unpatched AhsayCBS Flaws Exploited for Webshells
Threat actors are actively exploiting unpatched critical and medium-severity vulnerabilities in the AhsayCBS backup management platform.
