Summary
- CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalogue on 23 October.
- The flaw involves command injection in the optional built-in CODE Server component used with Nextcloud.
- Exposure depends on affected versions and service conditions; the notice does not implicate all Nextcloud installations.
The US Cybersecurity and Infrastructure Security Agency has added CVE-2026-110447, a command injection vulnerability affecting the built-in Collabora CODE Server used with Nextcloud, to its Known Exploited Vulnerabilities catalogue. The 23 October addition changes the evidence available to organisations deciding how urgently to investigate and update affected installations.
The vulnerability was disclosed earlier in October and has already been described by Cyber Insider. Its inclusion in the KEV catalogue is a separate development because CISA reserves that list for vulnerabilities with evidence of exploitation. The entry describes Collabora Online’s Built-in CODE Server and sets a 26 October remediation deadline under CISA’s Binding Operational Directive 26-04 for the applicable US federal civilian systems.
That deadline should not be presented as a universal legal obligation for UK or European enterprises. It relates to CISA’s federal operational framework and relevant US government requirements, while organisations elsewhere must consider their own obligations and risk exposure. The agency’s catalogue is nonetheless widely used as an input to vulnerability prioritisation because it distinguishes observed exploitation from theoretical severity alone.
CVE-2026-110447 concerns a command injection weakness in the optional richdocumentscode application, rather than Nextcloud Server in every configuration. The vulnerable proxy can be reachable under specific circumstances, including when the local document service is not running. In affected deployments, a crafted request can reach an operating-system command execution path without the authentication expected for normal document editing.
Collabora’s security advisory identifies version 26.4.303 as containing the fix. The National Vulnerability Database lists earlier versions of the built-in component as affected and records the CISA KEV addition. The exact exposure of any deployment depends on whether the optional component is installed, its version and the service state.
In practice, collaboration systems commonly incorporate separately updated elements. Nextcloud core, document integration applications, office editing services and associated reverse proxies may follow different release cycles. Updating Nextcloud itself does not necessarily update every supporting component, and a vulnerability in an optional integration is not evidence that all collaboration services are vulnerable.
Availability conditions form part of the issue’s technical mechanism. A local CODE process may become unavailable during a restart, upgrade or service problem while the proxy remains exposed. An organisation assessing the risk should therefore examine component configuration and operational behaviour rather than relying only on whether users can currently open a document editor.
CISA’s entry does not identify the attackers, the number of compromises or the sectors affected. It establishes exploitation status, not a campaign profile. Without separate victim evidence it would be inaccurate to claim that a particular UK council, European hospital or business has experienced a successful intrusion through this flaw.
The addition also highlights how patch urgency can change after a vulnerability is publicly known. A team may have initially prioritised the issue according to published severity and reachable attack conditions; confirmation of exploitation provides a further reason to examine unpatched installations and historical activity.
Operators using the built-in CODE Server should match their configuration against the vendor’s affected-version documentation and preserve relevant records if suspicious requests are identified. For unaffected Nextcloud environments, the existence of the catalogue entry is not itself evidence of a security incident.
The KEV entry’s named product also matters for vulnerability scanners and inventories. A scan that finds the broad Nextcloud platform may not identify whether the optional built-in CODE package is present or which package version the installation uses. Conversely, an inventory based only on the public-facing product name can omit the supporting application where the defect actually resides. Understanding that relationship improves remediation accuracy without exaggerating the number of exposed deployments.
The catalogue update establishes a new exploitation signal but leaves the scope and attribution of observed attacks undisclosed.
