Known exploitation affects the Collabora Built-in CODE Server app for Nextcloud before 26.4.303. Upgrade or remove the app; disabling it is insufficient.
Disclosed Updated Record reviewed UTCLatest evidence check UTC
The reviewed advisories establish exploitation in the wild, but do not document a separately validated research exploit demonstration. This does not mean exploit code is unavailable.
The vendor advisory describes unauthenticated command injection through proxy.php in Nextcloud’s richdocumentscode app. The vulnerable path requires the built-in CODE server to be stopped, which can happen after a restart, upgrade or crash. Standalone Collabora Online servers are excluded.
The vendor identifies 26.4.303 as the fixed app release. Merely disabling the app is insufficient; upgrade or remove it. For end-of-life Nextcloud 29 or older, the vendor advises upgrading Nextcloud or removing the app. The fix for CVE-2025-66208 does not address this separate vulnerability.
The public incident thread began September 11; the formal advisory was published October 14 and CISA added the CVE to KEV on October 23. These dates describe reporting and catalog inclusion, not the beginning of every attack. CISA does not confirm ransomware use in the reviewed entry.
Oktsec recommends preserving evidence and investigating the host for earlier compromise alongside remediation. Patch status alone cannot establish that files, credentials or documents remained untouched.
Affected systems and fixes
Product
Affected
Fixed release / action
Nextcloud app: richdocumentscode
Before 26.4.303; the attack path is reachable while the built-in CODE server is stopped
26.4.303
Confirm the running version against the vendor advisory, including any distribution backports.
CISA KEV evidence
Catalog 2026.10.23 · Checked Oct 24, 2026 UTC
CISA lists this CVE in its Known Exploited Vulnerabilities catalog. This confirms known exploitation, not compromise of your environment.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA’s federal deadlines and requirements are shown for context. They are not a universal deadline for private organizations or businesses in Latin America. The date added is the catalog inclusion date, not the first attack date.
Supporting evidence
Exploitation forecast
FIRST EPSS · Checked 2026-10-24 13:12 UTC
Product / CVE
EPSS · next 30 days
Exploitation evidence
Nextcloud · Collabora Built-in CODE ServerCVE-2026-110447Score: Oct 23, 2026
1.23%68.62% percentileNo change since Oct 22, 2026
Exploitation confirmedListed in CISA KEV
EPSS estimates exploitation in the next 30 days. Percentile is the score’s rank among CVEs. Confirmed exploitation still takes priority, even when EPSS is low. EPSS methodology
Collabora
Response checklist
0 of 3 complete
Sources
Technical facts come from these sources. Response priorities and recommended actions are Oktsec’s analysis.
Initial Radar publication after reviewing the vendor advisory, original incident thread, CVE record and October 23 CISA KEV inclusion. Exploitation is confirmed; the app-specific deployment condition and fixed version are explicit.