Critical RCE in Nextcloud Collabora app actively exploited for backdoors

Affected Systems

Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. Specific vulnerable versions not disclosed in provided data.

Exploitation Status

Active exploitation confirmed. Threat actors are backdooring servers in the wild.

Business Impact

Organizations running Nextcloud with the Collabora Online Built-in CODE Server app face immediate risk of server compromise and backdoor installation. Attackers can execute arbitrary commands remotely, leading to data theft, lateral movement, and persistent access. Patch status and affected version range not specified in available data.

Urgency

🔴 Immediate

Recommended Actions

• Immediately identify all Nextcloud instances running the Collabora Online - Built-in CODE Server app (richdocumentscode)
• Disable or isolate the richdocumentscode app until patches are applied and compromise is ruled out
• Check Nextcloud and web server logs for suspicious command execution attempts or unusual POST requests to Collabora endpoints
• Apply vendor patches from Collabora and Nextcloud as soon as available; monitor vendor security advisories for CVE-2026-110447
• Conduct forensic review of affected systems for indicators of compromise, including webshells, unauthorized user accounts, and scheduled tasks