CISA gave agencies three days to fix a Nextcloud add-on. Attacks began in September.
By Lior AharonovFounder, 7IT Solutions ·
What happened
On Friday 23 October 2026 CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog, with a due date of 26 October. The flaw sits in Collabora Built-in CODE Server (richdocumentscode) for Nextcloud: an unauthenticated request to proxy.php runs commands as the web server user while the CODE server is stopped. Collabora rates it Critical, CVSS 9.2, fixed in 26.4.303.
Why it matters
The door opens exactly when you are busy: a container restart, an upgrade, a crash. Your shared contracts, invoices and HR folders sit behind it. And turning the add-on off does not close it.
What to do
If you self-host Nextcloud with the built-in CODE app, upgrade richdocumentscode to 26.4.303 or remove it today, then look for unknown PHP files in the web root. Standalone Collabora servers are not affected.
Six weeks between the first attacks and the federal deadline. The attacker never waits for the paperwork, so neither should you.
Lior Aharonov · my takeSources
| CISA Known Exploited Vulnerabilities catalog (JSON feed) | cisa.gov |
| Collabora advisory GHSA-g3vx-3m76-fghh (GitHub) | github.com |
Researched with AI tools; every fact is checked against the linked sources.