By Thomas Anderson in Security News — 23 Oct 2026

CISA Added Collabora Online's CODE Server Flaw CVE-2026-110447 to KEV After Attackers Used proxy.php to Backdoor Nextcloud Servers — the Fix Has Been Out Since September

CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog on October 23, citing active exploitation: an operating system command injection in Collabora Online's Built-in CODE Server — the richdocumentscode package that gives Nextcloud its document editing — rated CVSS 9.2. The flaw allows remote code execution through proxy.php when the local document server is not running, and it was fixed in version 26.4.303, released back in September. Federal Civilian Executive Branch agencies have until October 26 to apply the fix, which means the victims here are not zero-day casualties: they are internet-exposed instances a month behind on a version bump.

According to The Hacker News, threat actors exploiting the flaw have been observed backdooring Nextcloud servers with a web shell and using it to run reconnaissance — hunting for credential stores, password manager artifacts, and cryptocurrency wallets on the compromised hosts. That loot list tells you who the targets really are: self-hosted Nextcloud instances, the small and mid-size deployments that put an office suite on the public internet because remote work demanded it, and that nobody re-visits when the vendor quietly ships a security release.

The same KEV batch added CVE-2026-114625 (CVSS 9.9), an SQL injection in on-premise Arista VeloCloud Orchestrator — the third flaw in that product to be weaponized since July, after two CVSS 10.0 zero-days — with exploitation requiring an authenticated session (minimum role: Enterprise Read Only) and Arista attributing the activity to two Japan-geolocated IPs. The connective theme is the one running through this entire month of KEV additions, from Plex2Shell to the Siemens and SiteGuard flaws in the October 21 order: anything internet-facing with a slow update cadence gets found, tested, and monetized — and the KEV clock (three days, this time) is now the fastest deadline in the industry.

For Nextcloud operators the practical question is deployment shape. The Built-in CODE Server is the bundled, easiest path to document editing in Nextcloud — which is exactly why it is widespread. An attacker who can reach proxy.php on a server where the document service is down doesn't need a Nextcloud account: the command injection happens in the glue code that was supposed to route editing sessions to the right container.

What Should You Do?

Update richdocumentscode to 26.4.303 or later — the fix shipped in September; anything older is KEV-listed and actively exploited. For FCEB agencies the deadline is October 26.
Inventory the middleware behind your Nextcloud — the CODE Server, richdocumentscode, and any document-conversion service are separate components with their own CVE histories, and they are as internet-facing as the main instance.
Treat proxy.php as attack surface — if the document server is down, that endpoint should fail closed, not fall back to a shell-capable path. Verify your instance's behavior after updating.
Hunt if you ran an old version exposed — web shells, unexpected outbound traffic, and access to password stores, developer credential files, and wallet artifacts are the observed post-exploitation behaviors. Credential rotation is cheaper than trusting a cleaned box.

The WAF Angle

Command injection through a document-processing endpoint is classic WAF territory — the malicious argument has to traverse the web tier to reach proxy.php, and argument-pattern filtering is what breaks it there. That is the same link in the chain this site keeps returning to: the Bricksforge upload-to-RCE chain lived in plugin glue code, and the observed post-exploitation here — web shell, then quiet hunting for credentials — is a smaller-scale echo of the Armory Castle espionage operation inside BeyondTrust. Request filtering on your Nextcloud's document endpoints buys time; the version bump closes the hole. Run both.

CISA Added Collabora Online's CODE Server Flaw CVE-2026-110447 to KEV After Attackers Used proxy.php to Backdoor Nextcloud Servers — the Fix Has Been Out Since September