Unpatched Collabora RCE Flaw Lets Attackers Backdoor Nextcloud Servers
Attackers are actively exploiting CVE-2026-110447, a critical unauthenticated remote code execution vulnerability in the Collabora Online (CODE) app bundled with Nextcloud, to plant webshells and exfiltrate sensitive data. The flaw requires no authentication, meaning any internet-exposed instance running a vulnerable version is at risk without any attacker credential requirements. This incident highlights the danger of delaying patches for internet-facing collaboration platforms, where exploitation timelines from disclosure to active attack can be extremely short. The presence of webshells also indicates attackers intend persistent, long-term access — making rapid detection and response equally as critical as patching.
Tactical Insight
Immediate actions
- Apply the vendor-released patch or upgrade the Collabora Online/CODE server app to a non-vulnerable version immediately.
- Temporarily restrict public internet access to Nextcloud/Collabora instances until patching is confirmed complete.
- Scan all Nextcloud servers for indicators of compromise, including unexpected webshells or new files in web-accessible directories.
Long-term improvements
- Implement an automated vulnerability scanning program that continuously monitors internet-facing applications for newly disclosed CVEs.
- Maintain a current, accurate software inventory (SBOM) of all third-party apps and integrations deployed on collaboration platforms.
- Establish and rehearse an emergency patching procedure with defined SLAs (e.g., critical CVEs patched within 24–48 hours).
Detection measures
- Deploy file integrity monitoring (FIM) on web server directories to alert on unauthorized file creation or modification.
- Centralize and actively monitor web server and application logs for anomalous POST requests, shell command patterns, or unexpected outbound connections.
- Configure network segmentation so that collaboration servers cannot initiate arbitrary outbound connections to unknown external hosts.