Vulnerability advisoriesCISA / Collabora Online

CISA adds an exploited vulnerability: update or remove Nextcloud's bundled CODE App

CISA has added a vulnerability in Collabora's built-in CODE Server to its known exploited list. It affects a specific Nextcloud add-on App and is fixed in version 26.4.303. The vendor warns that disabling the App alone is insufficient. Standalone Collabora servers are not affected by this issue.

Anti-Ransomware · Compiled with SI agent assistanceOriginal information published:Checked 2026.10.26
Original synthetic illustration of design studio colleagues checking shared files and maintenance arrangements
Illustration · Source ↗ · About this image ↗

Source Facts

On 23 October, CISA added CVE-2026-110447 to its KEV catalogue based on evidence of exploitation. Its directive applies to specified US federal agencies, while other organisations are encouraged to prioritise remediation according to risk.

Collabora's 14 October advisory says the issue affects Nextcloud's richdocumentscode built-in CODE Server App before version 26.4.303. When the built-in document server is not running, remote requests may be able to execute system commands.

The vendor requires an update to 26.4.303 or later, or removal of the App. Disabling it does not eliminate the risk. Independently deployed Collabora Online servers are unaffected. Older Nextcloud versions also require an upgrade or App removal as specified in the advisory.

Next Steps for Businesses / Editorial Observations

Identify the add-ons and deployment method actually in use before deciding whether an update covers the risk.

Next steps you can take

  • Check whether Nextcloud has richdocumentscode installed, then update or remove it according to the vendor advisory.
  • After patching, check services and suspicious logs. If there are signs of compromise, preserve evidence and respond under the incident process.

Original sources

Reporting leads · The Hacker News

The original material listed above has been traced. Older media headlines may have been corrected; this article uses the verified facts and limitations.

CISA Adds One Known Exploited Vulnerability to Catalog

Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.

This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.

Back to news ←

KEEP READING

Recommended reading

Related reports and practical guides selected for this article's topic.

Original synthetic illustration of modular container equipment and a tray with a defined boundaryIllustrationSecurity updates · 2026.10.26

Amazon Linux updates its Docker security advisory: check container hosts and archive handling

Amazon LinuxIllustration of a female bakery owner checking online orders and receiptsIllustrationVulnerability advisories · 2026.10.25

PHP patches and configuration follow-up: Unit 42 corrects its assessment of one intrusion's cause

PHP / Palo Alto Networks Unit 42Original scenario illustration of office colleagues checking computer updates and a maintenance checklistIllustrationSecurity updates · 2026.10.25

Emergency .NET update supplies a previously omitted fix: check Windows application versions again

Microsoft .NET