Unpatched Collabora CODE App Lets Attackers Backdoor Nextcloud Servers
Attackers exploited CVE-2026-110447, a critical unauthenticated remote code execution vulnerability in Collabora's CODE app bundled with Nextcloud, to plant persistent web shells on unpatched servers. The flaw was triggerable specifically when the local document server was not actively running, meaning even lightly-used or misconfigured deployments were at risk. This incident highlights the danger of third-party or bundled applications expanding an organization's attack surface without receiving the same patching scrutiny as the core platform. Because no authentication was required to exploit the flaw, any internet-facing Nextcloud instance with the CODE app installed was potentially exposed to full server compromise. Timely patching and active inventory management of all integrated components are essential to preventing this class of supply-chain-adjacent attack.
Tactical Insight
Immediate actions
- Update the Collabora CODE app to version 26.4.303 or later, or remove the app entirely if it is not actively needed.
- Audit all internet-facing Nextcloud instances to confirm the vulnerable app version is no longer present.
- Scan for existing web shells or indicators of compromise on any server that ran the vulnerable CODE app version.
Long-term improvements
- Maintain a comprehensive, up-to-date inventory of all third-party plugins, integrations, and bundled applications deployed alongside core platforms.
- Establish an emergency patching SLA (e.g., 24–48 hours) for critical-severity CVEs affecting internet-exposed services.
- Restrict access to document collaboration services to authenticated, internal or VPN-connected users where possible to reduce unauthenticated attack surface.
Detection measures
- Deploy file integrity monitoring on web server directories to alert on unexpected new files such as web shells.
- Enable and centralise application and web server logs, and create alerts for anomalous POST requests or unusual process spawning from web application processes.
- Integrate vulnerability feeds (e.g., NVD, vendor advisories) into your vulnerability management platform to receive real-time notification of newly disclosed CVEs affecting deployed software.