🔴 Critical: Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers
-
Researchers are seeing active exploitation of a critical remote code execution vulnerability in the Collabora Online - Built-in CODE Server app for Nextcloud, tracked as CVE-2026-110447. The flaw resides in the richdocumentscode component, which ships a bundled version of Collabora Online inside Nextcloud deployments to enable document editing and collaboration.
According to reports, attackers are leveraging this command execution issue to compromise exposed Nextcloud servers and establish persistent backdoors. The exact exploitation chain and post-exploitation tooling have not been detailed publicly, but the impact is severe: successful exploitation allows arbitrary code execution on the host, giving threat actors a foothold to maintain long-term access and potentially pivot deeper into victim environments.
Affected deployments are those running the richdocumentscode app with a vulnerable version of the bundled Collabora Online server.
Recommended actions for defenders:
- Identify any Nextcloud instances running the richdocumentscode app and confirm the installed version.
- Apply the vendor's patch or update as soon as one is available for CVE-2026-110447.
- If immediate patching is not possible, consider temporarily disabling the richdocumentscode app or restricting access to the affected endpoint.
- Review server logs for signs of unauthorized command execution, unexpected processes, or persistence mechanisms.
- Treat any confirmed compromise as a full host breach and conduct a thorough incident response, including credential rotation and integrity checks.
Given that exploitation is already ongoing in the wild, administrators should prioritize this over routine maintenance.
Source: BleepingComputer
Has anyone confirmed whether their Nextcloud deployment runs the richdocumentscode app, and if so, are you patching or disabling it?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login