A critical vulnerability identified as CVE-2026-110447 is being actively exploited by hackers to compromise Nextcloud servers through the Collabora Online Built-in CODE Server app. This flaw allows remote attackers to execute operating system commands without authentication, posing significant risks to affected systems. The vulnerability exists in versions of the richdocumentscode app prior to 26.4.303 and has been given a CVSS v4 score of 9.2, indicating its severity.

The vulnerability specifically targets a component within the app known as proxy.php, enabling attackers to execute commands with the permissions of the web server user. This exploit can occur during periods when the built-in CODE server is not running, such as during restarts or upgrades, creating potential attack windows. Although the commands do not run as root, the impact on data privacy, file integrity, and service availability is considerable.

Reports of compromised servers with web shells highlight the urgency of addressing this issue. Web shells allow attackers to maintain persistent access, underscoring the need for swift action by administrators. Collabora has issued a security advisory emphasizing that standalone Collabora Online servers remain unaffected, and that this vulnerability requires a separate resolution from previous flaws like CVE-2025-66208.

Administrators are urged to upgrade the richdocumentscode app to version 26.4.303 or later, or to remove it entirely. Merely disabling the app will not prevent exploitation. Additionally, systems running outdated Nextcloud versions 29 or earlier should be updated or have the vulnerable app removed. For systems previously exposed, it is crucial to inspect for unexpected PHP files to ensure no web shells remain, even after patching.