CVE-2026-110447: Nextcloud built-in CODE command injection needs an app update, not just disabling

CoeLab Real-World Impact: 78/100 — High. Editorial score v1.0. Evidence checked 2026-10-26T09:10:08.391896+00:00. CVSS and EPSS are separate measures, not this editorial score.

Rating breakdown: exploitation: 30, reachability: 25, consequences: 23, operational relevance: 0.

Who is affected

CVE-2026-110447 concerns Collabora Online – Built-in CODE Server, the richdocumentscode app installed within Nextcloud. It is not a general vulnerability in every Collabora deployment. The vendor explicitly excludes standalone Collabora Online servers. Administrators should identify the installed app and its version rather than assume that any use of online document editing establishes exposure.

The supplied CVE evidence identifies versions before 26.4.303 as affected. The vendor names 26.4.303 as the fixed release and instructs users to upgrade to that version or later, or remove the app. The community warning identifies 26.4.302 and older. These are product-version statements, not a claim that The Coe Lab independently tested every release or deployment configuration.

The vendor separately tells users on end-of-life Nextcloud 29 or earlier to upgrade Nextcloud or remove this app. Updating the surrounding platform and updating the built-in CODE app are distinct inventory checks. A standalone Collabora server should not be labeled vulnerable solely because its version number resembles an affected app release.

Real-world impact and exploitation evidence

The vendor describes unauthenticated operating-system command injection through proxy.php: a request can cause commands to execute as the web server user. That is a meaningful application-server compromise risk, but it does not establish root access or prove that every file or connected service is accessible. The actual consequences depend on the web server account's permissions and deployment boundaries.

The supplied CVE record reports exploitation during September and October 2026. An October 3 warning on Nextcloud's community forum already described exploitation and reports of web shells. This is reported exploitation evidence, not exploit testing by The Coe Lab or a count of independently confirmed victims. The supplied CISA KEV snapshot records addition on October 23 and a due date of October 26. The news is renewed prioritization of an existing vulnerability, not discovery of a new flaw today. The listed federal deadline is not a universal deadline for every reader.

CoeLab Real-World Impact v1.0 is 78/100, High. Its supplied components are exploitation 30, reachability 25, consequences 23 and operational relevance 0. KEV membership drives exploitation; network access, no required privileges and low complexity drive reachability; the published 9.2 CVSS score drives consequences. Zero operational-relevance points mean deployment prevalence and reader relevance were not established, not that the affected product is unimportant.

This editorial score is neither CVSS nor EPSS and is not a probability of compromise. The supplied October 25 EPSS estimate is 0.12328, a separate predictive measure. Neither that estimate nor the editorial total overrides evidence that exploitation has already occurred, and neither proves exposure in a particular organization.

Attack prerequisites

The important condition is that the built-in CODE server is not running. The vendor identifies container restarts, upgrades and crashes as examples of when this can happen. A currently running process is therefore not a durable substitute for fixing the vulnerable app. Operational events can change whether the vulnerable path is available.

The supplied CVSS v4.0 vector is CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, with a 9.2 score. It describes network attack access, no required privileges or user interaction, and an additional attack requirement. The vendor's stopped-server condition supplies essential context that a severity number alone would miss. An attacker still needs network access to the affected request path; the evidence does not establish which deployments expose it publicly.

Actions and fixes

First confirm whether richdocumentscode is installed and record its actual version. For affected installations, use the vendor-supported update process to reach 26.4.303 or later. If that cannot be done, the vendor's alternative is removal. Merely disabling the app is explicitly insufficient, so a disabled status should not close the remediation ticket.

After updating, verify the installed app version rather than relying only on an update notification or the status of the CODE process. For Nextcloud 29 or earlier, follow the vendor's platform-upgrade or app-removal guidance. The fix for CVE-2025-66208 does not prevent this issue: the vendor says this is a different path. Prior remediation of that older vulnerability should not be treated as evidence that this one is fixed.

Where the vulnerable app was reachable, evaluate whether incident-response review is needed alongside patching. Updating removes a known vulnerability; it does not establish that earlier compromise never happened or automatically remove an existing web shell. Preserve relevant evidence and use an established response process if suspicious activity is found. The reviewed advisory does not provide a complete forensic test, so this article does not invent indicators or claim that one clean log search proves safety.

Uncertainty and what could change

The reviewed evidence does not establish the original discovery date, total affected installations, victim count or ransomware involvement. September exploitation reports are not a precise discovery date. The CVE publication date in supplied intake is October 14, with its record updated October 24; those dates are distinct from the October 3 community warning and October 23 KEV addition. The extracted vendor advisory did not establish its own last-update date.

Additional vendor guidance could refine affected configurations or response recommendations. Until then, the practical decision is narrow: identify the built-in app, update or remove it, and do not mistake disabling it or keeping CODE running for a lasting fix. No claim here establishes that any particular reader's system is vulnerable or compromised.

Sources and evidence date

Evidence checked October 26, 2026. The linked Collabora security advisory supplies the execution context, stopped-server prerequisite, fixed version, removal guidance and standalone-server exclusion. The linked Nextcloud community warning supplies a dated public exploitation warning; community reports are distinguished from vendor findings. CVE metadata, CVSS, EPSS and KEV dates above come from the supplied intake evidence captured October 26, with EPSS dated October 25. This analysis contains no exploit payloads and involved no testing of affected systems.

Primary-source links

https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh

https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516

AI-assisted research and drafting, with a separate model editorial review. CoeLab ratings are editorial judgments, not a substitute for checking your own versions and vendor advisories. Methodology: https://thecoelab.com/blog/security/methodology