Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers

A critical command execution vulnerability in the Collabora Online Built-in CODE Server app for Nextcloud is being actively exploited, with attacks dating back to mid-September, about a month before the flaw received a CVE identifier and formal advisories. Tracked as CVE-2026-110447, the flaw affects richdocumentscode versions before 26.4.303 and lies in the app's method for launching the bundled Collabora server. Only the optional built-in CODE server app is vulnerable, according to Collabora; standalone Collabora Online servers, Docker and RPM/DEB installations, and Nextcloud All-in-One deployments are not affected.

Attackers trigger the flaw by sending a crafted request to the app's proxy.php endpoint, causing OS command injection. Exploitation requires that the built-in CODE server be in a stopped state, which can occur after a restart, upgrade or crash. No authentication or user interaction is needed. Administrators began reporting malicious activity against multiple endpoints on September 10.

Those reports describe attackers planting PHP webshells and using them to hunt for password databases, password manager artifacts and cryptocurrency wallets. Some users said ransomware operators were also exploiting the flaw, though BleepingComputer could not independently verify that claim.

Administrators are advised to move to version 26.4.303 or later, or to remove the app if it is not required. The vendor cautioned that merely disabling the app does not resolve the issue. Maintainers issued mid-September warnings, and a community alert followed on October 3 urging immediate updates because exploitation was ongoing. Without a CVE ID, administrators had difficulty matching the problem to the right fix and rolling out defenses.

A study by cybersecurity firm Second Security highlights the gap between fixes and formal vulnerability notices. Examining open-source flaws, the firm found the median time between a public fix and CVE publication was 39 days in August, compared with 5.1 days in January. Second Security attributes the delays to rising volumes of AI-assisted vulnerability discoveries straining CVE processing, and found public exploit code often appeared within hours of a fix and days before the CVE. Nextcloud told BleepingComputer that Collabora reported the vulnerability in mid-September and an update reached the app store, saying the disclosure delay gave users time to update and that widespread exploitation had not been observed. Collabora, in a blog post, attributed the delayed announcement largely to GitHub CVE-processing backlogs strained by increasing volumes of AI-driven security reports.

For Collabora, the fix was committed September 9 and version 26.4.303 arrived September 11; the advisory and CVE were published October 14, a gap of more than four weeks. The episode underscores how AI tools let attackers quickly build working exploits for published fixes, leaving defenders to connect patches to unassigned vulnerabilities.

More cybersecurity news from TechManNews.