Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers
Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers via CVE-2026-110447.
Threat actors are actively exploiting a critical command execution vulnerability (CVE-2026-110447) in the Collabora Online app for Nextcloud, allowing them to backdoor servers. Attacks began in mid-September, with attackers planting webshells to search for sensitive data. The vulnerability impacts specific versions of the built-in CODE server app and requires the server to be stopped for exploitation, with no authentication needed.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Collabora?
Get an email when a new story names Collabora, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers are actively exploiting CVE-2026-110447, a critical unauthenticated remote code execution vulnerability in the Collabora Online (CODE) app bundled with Nextcloud, to plant webshells and exfiltrate sensitive data. The flaw requires no authentication, meaning any internet-exposed instance running a vulnerable version is at risk without any attacker credential requirements. This incident highlights the danger of delaying patches for internet-facing collaboration platforms, where exploitation timelines from disclosure to active attack can be extremely short. The presence of webshells also indicates attackers intend persistent, long-term access — making rapid detection and response equally as critical as patching.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-110447