According to reports, attackers are leveraging this command execution issue to compromise exposed Nextcloud servers and establish persistent backdoors. The exact exploitation chain and post-exploitation tooling have not been detailed publicly, but the impact is severe: successful exploitation allows arbitrary code execution on the host, giving threat actors a foothold to maintain long-term access and potentially pivot deeper into victim environments.

Affected deployments are those running the richdocumentscode app with a vulnerable version of the bundled Collabora Online server.

Recommended actions for defenders:

• Identify any Nextcloud instances running the richdocumentscode app and confirm the installed version.
• Apply the vendor's patch or update as soon as one is available for CVE-2026-110447.
• If immediate patching is not possible, consider temporarily disabling the richdocumentscode app or restricting access to the affected endpoint.
• Review server logs for signs of unauthorized command execution, unexpected processes, or persistence mechanisms.
• Treat any confirmed compromise as a full host breach and conduct a thorough incident response, including credential rotation and integrity checks.

Given that exploitation is already ongoing in the wild, administrators should prioritize this over routine maintenance.

Source: BleepingComputer

Has anyone confirmed whether their Nextcloud deployment runs the richdocumentscode app, and if so, are you patching or disabling it?