Detections
Analytics

CVE-2026-110447

critical

Description

Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.

References

https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516

https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/

https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html

https://github.com/Iceman2050/cve-to-checker

https://github.com/Iceman2050/cve-2026-110447-checker

https://github.com/CollaboraOnline/richdocumentscode/issues/354

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-100780

Details

Source: Mitre, NVD

Published: 2026-10-14

Updated: 2026-10-16

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

CVSS v4

Base Score: 9.2

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Severity: Critical

EPSS

EPSS: 0.01225

Vulnerability Watch

Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.

Vulnerability of Interest