CISA Flags Nextcloud’s Built-In Collabora Server Flaw: Who Needs to Update?

CISA has added a critical vulnerability in a Nextcloud office component to its Known Exploited Vulnerabilities catalog. The flaw, tracked as CVE-2026-110447, affects a specific deployment: Collabora Online’s Built-in CODE Server app for Nextcloud, not every Nextcloud installation or every Collabora server.

The distinction is important for organizations deciding whether to act. The CVE record says the flaw was exploited in the wild in September and October 2026. CISA added it to the KEV catalog on October 23. For administrators in Pakistan, the immediate question is whether their Nextcloud instance uses the affected built-in app.

Which Nextcloud setup is affected?

The vulnerable component is the Nextcloud app named richdocumentscode, also called Collabora Online – Built-in CODE Server. It bundles a document-editing server inside a Nextcloud installation. The Nextcloud App Store says the app is used together with the Nextcloud Office integration and provides a built-in server for document editing.

For a quick inventory, check Nextcloud’s installed-app list for this exact app name or richdocumentscode. The Nextcloud Office integration and the bundled server are related but separate components. If the deployment points to a separately managed Collabora server, ask the administrator or provider to verify that setup before applying this specific CVE advice.

Collabora’s security advisory says versions before 26.4.303 are affected. A request to the app’s proxy.php can trigger an operating-system command that runs with the web server’s privileges. The advisory says the attack works only while the built-in CODE server is not running—for example, after a restart, upgrade or crash.

This is not a flaw in all office files or in the general Nextcloud platform. Collabora says standalone Collabora Online servers are not affected by this CVE. The risk is specifically tied to the vulnerable built-in app in a Nextcloud deployment.

What administrators should do

Collabora lists version 26.4.303 as the fix. The vendor says disabling the app alone is not enough: administrators should upgrade it to 26.4.303 or later, or remove it if it is not needed. Users running end-of-life Nextcloud 29 or older should upgrade Nextcloud or remove the app.

Start by checking the installed apps in the Nextcloud administration panel or asking the hosting provider whether richdocumentscode is present and what version it runs. If it is older than 26.4.303, arrange the update or removal, then verify that the updated version is actually installed. Managed-hosting customers should ask their provider to confirm the app version and remediation rather than assume a general Nextcloud update included it.

Organizations should also review whether the affected service is reachable from the public internet and follow their incident-response process if they find indicators of compromise. Updating closes the vulnerable path, but it does not by itself establish whether an earlier intrusion occurred.

What CISA’s listing means—and what it does not

CISA’s KEV catalog tracks vulnerabilities known to be exploited. Its entry gives October 26 as the remediation due date for U.S. federal civilian agencies under Binding Operational Directive 26-04. That date is not a compliance deadline for Pakistani organizations, but the exploited-in-the-wild record makes the advisory relevant to administrators everywhere who run the affected app. CISA’s entry lists ransomware-campaign use as “Unknown.”

For Pakistani universities, businesses, public-interest organizations and hosting providers that self-host Nextcloud, this is a targeted configuration check rather than a reason to take every collaboration service offline. If the built-in CODE Server is absent, or if an organization uses a standalone Collabora server, this particular CVE does not apply according to Collabora’s advisory. If the vulnerable app is present, verify the version and patch or remove it promptly.

Sources

• Collabora Online — Unauthenticated OS Command Injection in the richdocumentscode Proxy
• CISA — Binding Operational Directive 26-04
• CVE.org — CVE-2026-110447
• CISA — Known Exploited Vulnerabilities Catalog
• Nextcloud App Store — Collabora Online Built-in CODE Server