CISA orders federal agencies to patch actively exploited Nextcloud document-editor flaw

The US Cybersecurity and Infrastructure Security Agency added a critical flaw in a widely used Nextcloud component to its Known Exploited Vulnerabilities catalog on October 23, giving federal civilian agencies until October 26 to patch it. The flaw, tracked as CVE-2026-110447, sits in the Built-in CODE Server app, known in Nextcloud's app store as richdocumentscode, which bundles Collabora Online's office-document engine directly into a self-hosted Nextcloud installation.

According to the GitHub Security Advisory for the flaw, it is an operating-system command injection in a script called proxy.php that can be triggered by an unauthenticated network request, with no user interaction required. The advisory carries a CVSS v4 score of 9.2, close to the maximum of 10, and the CISA catalog entry confirms it has already been used in real attacks. The bug works only in a specific condition: the bundled document-conversion server has to be stopped, which happens routinely after a restart, an upgrade or a crash, a state administrators are not always aware of.

What attackers did

Exploitation did not begin with the public disclosure. Researchers and system administrators reported attacks weeks before the flaw was formally named. The fix was committed to the project's code on September 9, and version 26.4.303 carrying that fix shipped on September 11, according to reporting by BleepingComputer. Attacks against unpatched servers were already being logged on September 10, the day before that update went out, and continued afterward against installations that had not yet upgraded. A warning posted to the Nextcloud community forum on October 3 urged administrators to update immediately because exploitation was ongoing. The formal security advisory and CVE identifier were not published until October 14, more than a month after the silent fix.

In the attacks described by BleepingComputer and by The Hacker News, intruders sent crafted requests to the proxy.php endpoint to run commands as the web-server account, then dropped single-file PHP webshells into the app's own directory, with filenames typically beginning "shx". On at least one compromised server, the attacker searched for password-manager files and cryptocurrency-wallet data. Neither outlet found confirmed evidence that attackers escalated to root access on the underlying machine, and BleepingComputer said it could not independently verify separate claims that ransomware operators had also exploited the flaw.

Who is affected and who is not

The exposure is narrower than a typical Nextcloud vulnerability. Collabora's advisory, as reproduced in eSecurityPlanet's coverage, states that standalone Collabora Online servers, as well as installations run through Docker, RPM or DEB packages, and the Nextcloud All-in-One bundle, are not affected. Only Nextcloud operators who opted for the convenience of the integrated, "built-in" document editor are exposed. That still covers a meaningful population: Nextcloud is run by businesses, universities, nonprofits, and government bodies worldwide as a self-hosted alternative to commercial cloud-storage services, precisely the kind of institution likely to choose the simpler bundled setup over a separate server. Nextcloud versions 29 and earlier are already past their own end-of-life date and cannot install the fixed 26.4.303 app build at all, so operators on those older releases have no option but to upgrade Nextcloud itself or remove the vulnerable app outright.

The GitHub Security Advisory lists no confirmed patched version, and the only fixed release identified in reporting on the flaw is 26.4.303 of the richdocumentscode app. Patching alone also does not undo damage already done. Administrators who update a server that was compromised before the fix was applied still need to search their systems for leftover webshell files and other signs of persistence, since the update closes the entry point but does not remove anything an intruder already planted.

A wider pattern in vulnerability disclosure

The month-long gap between Collabora's quiet fix and its public advisory drew separate scrutiny. Collabora told reporters the delay was due largely to a backlog in GitHub's advisory-processing pipeline, which it linked to a sharp rise in vulnerability reports generated with the help of AI tools. BleepingComputer cited research from the firm Second Security finding that the median gap between a public code fix and the matching CVE's publication across the industry grew from roughly five days in January 2026 to about 39 days in August, a trend researchers say gives attackers a longer window to find and weaponize fixes before defenders know a vulnerability even has a name.

What happens next

The October 26 deadline in the CISA catalog applies formally only to US federal civilian agencies, under the binding operational directive that governs the Known Exploited Vulnerabilities list, but security teams generally treat a KEV listing as a signal that any organization running the affected software should treat the update as urgent regardless of sector. Collabora's guidance remains straightforward: update richdocumentscode to version 26.4.303 or a later patched release, or remove the app entirely, and check logs and the app directory for signs of prior compromise before considering a server clean.