Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers
Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers via CVE-2026-110447.
Run Collabora?
Get an email when a reviewed story names Collabora, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Threat actors are actively exploiting a critical command execution vulnerability (CVE-2026-110447) in the Collabora Online app for Nextcloud, allowing them to backdoor servers. Attacks began in mid-September, with attackers planting webshells to search for sensitive data. The vulnerability impacts specific versions of the built-in CODE server app and requires the server to be stopped for exploitation, with no authentication needed.
The lesson from this incident
Full lessonAttackers are actively exploiting CVE-2026-110447, a critical unauthenticated remote code execution vulnerability in the Collabora Online (CODE) app bundled with Nextcloud, to plant webshells and exfiltrate sensitive data. The flaw requires no authentication, meaning any internet-exposed instance running a vulnerable version is at risk without any attacker credential requirements. This incident highlights the danger of delaying patches for internet-facing collaboration platforms, where exploitation timelines from disclosure to active attack can be extremely short. The presence of webshells also indicates attackers intend persistent, long-term access — making rapid detection and response equally as critical as patching.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
- cve — CVE-2026-110447