What is CVE-2026-110447?

Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.

CISA added this issue to its exploited-vulnerability catalog on 2026-10-23. This is the catalog date, not this article’s publication date.

Sources: CISA Known Exploited Vulnerabilities catalog, CVE-2026-110447 — NVD, CVE-2026-110447 — CVE Program record

First, confirm where the vulnerable product is running

CVE-2026-110447 affects Collabora Online Built-in CODE Server (the Nextcloud app 'richdocumentscode') before version 26.4.303. The flaw is an OS command injection in proxy.php that triggers when the CODE server is not running, such as immediately after a restart. Exploitation in the wild was observed in September and October 2026. Standalone Collabora Online servers are not affected; only this specific Nextcloud-integrated deployment model is vulnerable. The CISA entry requires mitigations per vendor instructions and adherence to BOD 26-04 patching timelines. Because the CVE record does not provide a fixed version in the structured catalog, confirm the exact remediation version and steps in the vendor advisory and the linked GitHub issue. Cloud remediation depends on how the Nextcloud/Collabora stack is deployed: customer-managed VMs, containers, or a vendor-supported appliance each have different update paths. Do not assume a managed cloud service (e.g., a SaaS Nextcloud offering) is affected or unaffected without evidence from that provider.

The named vulnerable product is Collabora Collabora Online – Built-in CODE Server. Deployment on a cloud platform does not by itself establish that a managed AWS, Azure or GCP service is vulnerable. Confirm the product, version, vendor-supported deployment and remediation owner.

Vendor remediation comes first

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Use the current vendor advisory for affected versions and fixed builds. This catalog entry does not establish a universal fixed version or a cloud-specific hotfix.

Sources: CISA Known Exploited Vulnerabilities catalog, CVE-2026-110447 — NVD

AWS: remediation and deployment checks

Use these checks only if your inventory confirms an affected, vendor-supported deployment in this environment.

  1. Identify every EC2 instance or on-premises server (via Systems Manager) running Nextcloud with the richdocumentscode app; confirm the Collabora Online version deployed.
  2. For customer-managed workloads, apply the vendor-supported upgrade to richdocumentscode 26.4.303 or later using the standard Nextcloud app update mechanism or the vendor's documented appliance upgrade; do not rely on OS package managers for this app.
  3. If using a container image on ECS/EKS, pull the vendor-supported image tag that includes the fix and redeploy; verify the image digest matches the vendor advisory.
  4. After update, verify the Nextcloud admin panel shows richdocumentscode >= 26.4.303 and that the CODE server starts correctly on demand.

Sources: AWS Systems Manager Patch Manager

Azure: remediation and deployment checks

Use these checks only if your inventory confirms an affected, vendor-supported deployment in this environment.

  1. Enumerate Azure VMs and Arc-connected machines hosting Nextcloud with the built-in CODE Server; check the installed richdocumentscode version.
  2. For customer-managed deployments, follow the vendor's upgrade procedure for the richdocumentscode app to 26.4.303 or later; Azure Update Manager handles OS packages, not this Nextcloud app.
  3. For AKS-hosted deployments, update the container image to the vendor-supported fixed tag and roll out the new pods; confirm the image source is the official vendor registry.
  4. Validate the fix by checking the Nextcloud Apps page for the updated version and testing document editing after a CODE server restart.

Sources: Azure Update Manager overview

GCP: remediation and deployment checks

Use these checks only if your inventory confirms an affected, vendor-supported deployment in this environment.

  1. List Compute Engine VMs (via VM Manager inventory) running Nextcloud with richdocumentscode; note the current app version.
  2. Apply the vendor-provided upgrade for the richdocumentscode Nextcloud app to 26.4.303 or later; VM Manager patches the OS, not the Nextcloud app itself.
  3. For GKE deployments, replace the container image with the vendor-supported fixed version and redeploy; ensure the image comes from the official vendor source.
  4. Confirm remediation by verifying the app version in Nextcloud administration and confirming CODE server spawns without error after a restart.

Sources: Google Cloud VM Manager — About Patch

How to verify the fix

  1. In the Nextcloud web admin interface, navigate to Apps > Enabled apps and confirm 'Collabora Online - Built-in CODE Server' (richdocumentscode) shows version 26.4.303 or newer.
  2. Restart the Nextcloud/Collabora stack and observe that the CODE server starts successfully and document editing loads without proxy errors.
  3. Check the Collabora/Nextcloud logs for any command-injection attempts or proxy.php errors that would indicate exploitation attempts.
  4. If a vendor appliance is used, run the vendor's built-in health/version check command to confirm the patched release is active.

Questions teams ask

Does this vulnerability affect standalone Collabora Online servers (not the built-in CODE Server)?

No. The CVE description explicitly states the vulnerability is not present in standalone Collabora Online servers; only the Nextcloud-integrated Built-in CODE Server (richdocumentscode) is affected.

What is the fixed version for the richdocumentscode app?

The CVE record cites version 26.4.303 as the fixed release. The structured catalog entry does not list a fixed version; verify the exact version and upgrade steps in the vendor advisory (GitHub issue #354) and the Nextcloud community thread.

Can I use my cloud provider's patch manager (AWS Systems Manager, Azure Update Manager, GCP VM Manager) to fix this?

Those services manage operating-system packages. The vulnerable component is a Nextcloud app (richdocumentscode), which is updated through Nextcloud's app mechanism or the vendor's appliance/container image, not via OS package managers.

Is a managed Nextcloud SaaS offering (e.g., a hosted Nextcloud provider) affected?

The supplied sources do not establish whether any specific managed Nextcloud service is affected or unaffected. Contact your SaaS provider for their patch status and confirmation of the richdocumentscode version they run.

Sources & further reading

This brief summarizes public source material. Confirm affected versions and the current vendor instructions before changing production. No original exploit validation is claimed.