[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fWMT59cwrFN06p5hJL4I1HwWn0FdO_UI7eFrsDefJ-xE":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":34,"created_at":35,"published_at":36,"article":37,"tags":41,"podcasts":60,"controls":61},"d18c17d0-eaf7-413e-a2a3-b5f7592f9780","unpatched-collabora-code-app-lets-attackers-backdoor-nextcloud-servers","0ae0c831-9e79-472d-a5f3-a297db67f020","Unpatched Collabora CODE App Lets Attackers Backdoor Nextcloud Servers","Attackers exploited CVE-2026-110447, a critical unauthenticated remote code execution vulnerability in Collabora's CODE app bundled with Nextcloud, to plant persistent web shells on unpatched servers. The flaw was triggerable specifically when the local document server was not actively running, meaning even lightly-used or misconfigured deployments were at risk. This incident highlights the danger of third-party or bundled applications expanding an organization's attack surface without receiving the same patching scrutiny as the core platform. Because no authentication was required to exploit the flaw, any internet-facing Nextcloud instance with the CODE app installed was potentially exposed to full server compromise. Timely patching and active inventory management of all integrated components are essential to preventing this class of supply-chain-adjacent attack.","**Immediate actions:**\n- Update the Collabora CODE app to version 26.4.303 or later, or remove the app entirely if it is not actively needed.\n- Audit all internet-facing Nextcloud instances to confirm the vulnerable app version is no longer present.\n- Scan for existing web shells or indicators of compromise on any server that ran the vulnerable CODE app version.\n\n**Long-term improvements:**\n- Maintain a comprehensive, up-to-date inventory of all third-party plugins, integrations, and bundled applications deployed alongside core platforms.\n- Establish an emergency patching SLA (e.g., 24–48 hours) for critical-severity CVEs affecting internet-exposed services.\n- Restrict access to document collaboration services to authenticated, internal or VPN-connected users where possible to reduce unauthenticated attack surface.\n\n**Detection measures:**\n- Deploy file integrity monitoring on web server directories to alert on unexpected new files such as web shells.\n- Enable and centralise application and web server logs, and create alerts for anomalous POST requests or unusual process spawning from web application processes.\n- Integrate vulnerability feeds (e.g., NVD, vendor advisories) into your vulnerability management platform to receive real-time notification of newly disclosed CVEs affecting deployed software.",[12,13,14,15,16,17,18,19,20,21,22],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST SP 800-53 CM-8: System Component Inventory","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","NIST CSF ID.AM-2: Software platforms and applications are inventoried","NIST CSF RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","GDPR Article 32: Security of processing (applicable if personal data stored in Nextcloud)","ITIL Change Management: Emergency change procedures for critical vulnerability remediation",{"NIST SP 800-53 SI-2: Flaw Remediation":24,"NIST SP 800-53 CM-8: System Component Inventory":25,"CIS Control 12: Network Infrastructure Management":26,"CIS Control 7: Continuous Vulnerability Management":27,"CIS Control 2: Inventory and Control of Software Assets":28,"NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity":29,"NIST CSF ID.AM-2: Software platforms and applications are inventoried":30,"GDPR Article 32: Security of processing (applicable if personal data stored in Nextcloud)":31,"ITIL Change Management: Emergency change procedures for critical vulnerability remediation":32,"NIST CSF RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks":33},"Requires timely remediation of the Collabora flaw.","Component inventory tracks bundled apps like Collabora CODE, which can be overlooked.","Limiting exposure of Nextcloud servers reduces the attack surface.","Rapid patching of Collabora CODE closes CVE-2026-110447 before web shells are planted.","A software inventory shows which Nextcloud servers include the Collabora CODE app.","Integrity monitoring can detect web shells planted on Nextcloud servers.","Inventorying software includes bundled components, such as Collabora in Nextcloud.","Requires appropriate security for personal data stored in Nextcloud.","Emergency change procedures help deploy critical fixes quickly.","Requires mitigating new vulnerabilities, such as disabling CODE until patched.","published","2026-10-14T20:20:55.008136+00:00","2026-10-14T20:20:54.985+00:00",{"id":7,"url":38,"slug":39,"title":40},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fhackers-backdoor-nextcloud-servers.html","hackers-backdoor-nextcloud-servers-through-critical-flaw-in-collabora-s-built-in-272064","Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App",[42,48,54],{"id":43,"name":44,"slug":45,"description":46,"color":47},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":49,"name":50,"slug":51,"description":52,"color":53},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":55,"name":56,"slug":57,"description":58,"color":59},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[62,65,68],{"slug":45,"name":63,"problem":64},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":57,"name":66,"problem":67},"Automated patch management","Known holes get closed in days, not months.",{"slug":69,"name":70,"problem":71},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]