Collabora Online Built-in CODE Server OS command injection allows remote code execution (CVE-2026-110447)

What happened

CVE-2026-110447 is a critical OS command injection vulnerability in proxy.php, part of the built-in CODE Server bundled with the richdocumentscode Nextcloud app. When the CODE server is not running — for example, just after the Nextcloud app or its host has been restarted — an attacker can send a crafted request over the network and achieve remote code execution without authentication or user interaction. The condition is specific, but no credentials are needed and the technical impact is total.

The CVE record says the flaw has been exploited in the wild in September and October 2026. CISA's Known Exploited Vulnerabilities catalogue, CISA SSVC and ENISA EUVD all list it as actively exploited; ENISA records exploitation since 23 October 2026, and CISA added the entry with a due date of 26 October 2026. The CVE record describes this as a different vulnerability from CVE-2025-66208.

The flaw is not present in standalone Collabora Online servers. Only deployments using the built-in CODE Server option are affected.

Who is affected

The affected product is Collabora Online - Built-in CODE Server (the richdocumentscode Nextcloud app), all versions before 26.4.303. This is the typical deployment for Nextcloud instances that bundle Collabora Online for document editing. Standalone Collabora Online servers are not affected. Organisations running the embedded CODE Server option should treat themselves as affected until the update is applied.

What to do now

1. Update Collabora Online - Built-in CODE Server to version 26.4.303. This is the fixed version listed in the CVE record and the fix is available.
2. If you cannot update immediately, follow CISA's KEV required action: apply mitigations in accordance with vendor instructions, ensure compliance with BOD 26-04, and discontinue use of the product if mitigations are unavailable. The KEV due date is 26 October 2026.
3. Restrict network access to the Nextcloud instance until the update is complete, and verify that the CODE server is running after any restart. The vulnerability is only present when the CODE server is not running, but no additional vendor workaround is published in the references.

How to detect it

No vendor indicators of compromise are published in the CVE record or the references. Until the patch is applied, treat any unusual command execution on the host running the Nextcloud app as suspicious, particularly shortly after a restart when the CODE server may not yet be running. Log access to proxy.php and review successful requests that occur while the CODE server is down.

Beyond the patch

Active exploitation makes this a detection and response problem as much as a patching problem; Managed Detection & Response (MDR) and an Incident Response Retainer give you a known escalation path if a compromise is already present. Because the flaw is reachable over the network without credentials, the main exposure is an internet-facing Nextcloud instance; Virtual CISO Services (vCISO) can help review that exposure before the next advisory lands.