Threat actors have been exploiting a critical remote code execution vulnerability in the Collabora Online integration for Nextcloud since mid-September. The flaw, identified as CVE-2026-110447, allows attackers to execute arbitrary commands on affected servers. Multiple administrators reported unauthorized access and suspicious activity weeks before the vulnerability was officially disclosed. The attacks targeted the richdocumentscode app, a component used to enable real-time document editing within Nextcloud environments.
The vulnerability stems from improper input validation in the Collabora Online server component, enabling unauthenticated attackers to inject and execute system commands. Security researchers noted that exploitation began approximately one month prior to the public advisory, suggesting threat actors had advance knowledge or conducted independent discovery. Affected instances showed signs of backdoor installation, including unexpected cron jobs and unauthorized user accounts. The delay between exploitation and disclosure raises concerns about the window of exposure for organizations relying on the integration.
Once inside, threat actors used the command execution capability to deploy web shells and modify system configurations. Log analysis from compromised servers revealed repeated attempts to establish reverse connections to external IP addresses. Some victims reported data exfiltration attempts targeting configuration files and user databases. The attackers appeared focused on maintaining long-term access rather than immediate disruption, indicating a potential espionage or data theft motive. Nextcloud’s security team confirmed that the vulnerability could be exploited without authentication, increasing its severity.
Immediate action is required to mitigate risk, including updating the Collabora Online app to the patched version released alongside the advisory. Administrators should review server logs for signs of compromise, particularly unexpected processes or network connections. Resetting administrator credentials and auditing user permissions are recommended follow-up measures. Organizations unable to update immediately are advised to disable the richdocumentscode app temporarily. Continuous monitoring for anomalous behavior remains critical even after patching.
How can I tell if my Nextcloud server was compromised? Look for unfamiliar user accounts, unexpected scheduled tasks, or outbound connections to unknown IP addresses in system logs. Sudden changes to configuration files or the appearance of unknown web shells in server directories are also strong indicators.
Is the vulnerability exploitable if Collabora Online is not enabled? No, the flaw only affects systems where the richdocumentscode app is installed and active. Disabling or removing the app eliminates the attack vector until a patch can be applied.