Clarissa Hana
Threat actors have actively exploited a critical command execution vulnerability, now formally identified as CVE-2026-110447, within the Collabora Online – Built-in CODE Server app, commonly known as richdocumentscode, for Nextcloud. This exploitation began approximately a month before the official security bulletin, GitHub advisory, and CVE publication, leaving many systems exposed to malicious activities. The vulnerability lies in the mechanism used by the Nextcloud app to initiate its bundled Collabora server.
Discovery and Exploitation Timeline
Reports from multiple system administrators began surfacing in mid-September, detailing unauthorized access and malicious activity on their Nextcloud instances. These reports predated the official security advisories and the formal CVE assignment by nearly a month. The exploitation chain was initiated by sending specially crafted, malicious requests to the proxy.php endpoint of the richdocumentscode app. This endpoint is responsible for proxying requests to the embedded Collabora server.
A critical prerequisite for successful exploitation is that the built-in CODE server must be in a stopped state. This often occurs following routine server restarts, software upgrades, or unexpected crashes. Crucially, the vulnerability does not require any form of authentication or prior user interaction to be triggered, making it a highly potent tool for attackers. Once the command injection is successful, threat actors have been observed deploying PHP webshells, which act as persistent backdoors, allowing them to execute arbitrary commands on the compromised server.
The immediate aftermath of successful exploitation has seen attackers actively searching for sensitive data. System administrators who reported these attacks, dating back to September 10th, indicated that the malicious actors were targeting password databases, artifacts from password managers, and cryptocurrency wallets. This suggests a multi-faceted motive, ranging from credential theft to financial gain. Some reports also suggested that ransomware operators were leveraging this vulnerability, although this claim could not be independently verified by this publication.
Technical Details of the Vulnerability
CVE-2026-110447 specifically impacts versions of the richdocumentscode app prior to 26.4.303. The vulnerability resides within the app’s internal handling of requests to start the bundled Collabora server component. By manipulating these requests, an attacker can inject operating system commands that are then executed with the privileges of the web server process.
It is important to note that this vulnerability affects only the optional, built-in CODE server app that is integrated directly into Nextcloud. Standalone Collabora Online server installations, including those deployed via Docker containers or traditional package managers (RPM/DEB), as well as Nextcloud All-in-One deployments, are not affected by this specific flaw, according to assurances from Collabora. This distinction is critical for administrators attempting to assess their risk exposure.
Official Responses and Mitigation
Following the discovery and initial reports, Collabora released version 26.4.303 of the richdocumentscode app, which addresses the CVE-2026-110447 vulnerability. System administrators are strongly advised to upgrade to this version or any subsequent releases as soon as possible. For organizations that do not utilize the built-in Collabora CODE server functionality, the recommended mitigation is to completely remove the richdocumentscode app from their Nextcloud instances. Collabora has explicitly warned that simply disabling the app is insufficient to patch the vulnerability.
The timeline of disclosure highlights a significant gap between the availability of a fix and its formal notification to the wider community. The fix for this vulnerability was committed by developers on September 9th, and version 26.4.303 was released on September 11th. However, the official security advisory and the CVE assignment were not published until October 14th, creating a gap of over four weeks during which the vulnerability was actively exploited.
A community warning was also published on the Nextcloud help forum on October 3rd, urging administrators to update immediately due to ongoing exploitation. Despite these warnings, the absence of a formal CVE ID made it challenging for many administrators to precisely identify and prioritize the threat, hindering their ability to implement timely and effective defenses.
Nextcloud, when contacted for comment, stated that Collabora had reported the vulnerability in mid-September, and an update was made available through the app store. The company defended the delayed official disclosure by suggesting it provided users with an opportunity to update without causing widespread panic, noting that they had not observed "widespread exploitation."
Collabora, in a blog post addressing the activity, attributed the delayed announcement primarily to backlogs within the CVE processing system managed by GitHub. They cited increasing volumes of AI-driven security reports as a strain on these processing pipelines, leading to extended publication times.
The Widening Gap Between Fixes and Formal Notifications
The situation with CVE-2026-110447 is emblematic of a growing trend in the cybersecurity landscape, where the time lag between the availability of a security fix and its formal public notification through a CVE ID is increasing. A study conducted by cybersecurity firm Second Security sheds light on this issue. Their analysis of real-world open-source vulnerabilities revealed that the median interval between the public release of a fix and the publication of its corresponding CVE ID expanded significantly, reaching 39 days in August, a sharp increase from just 5.1 days in January of the same year.
This growing delay has significant implications for system security. The Second Security study further highlighted that public proof-of-concept (PoC) exploit code often emerges online within hours of a security fix being committed, and several days before the official CVE is published. This creates a critical window of opportunity for attackers.
The researchers from Second Security posit that the proliferation of AI-assisted vulnerability discovery tools is a contributing factor to these delays. These tools enable threat actors to more rapidly identify vulnerabilities and develop working exploits for disclosed fixes. The ease with which AI can generate exploit code from publicly available information means that even if a fix is available, attackers can weaponize it before it’s formally recognized and cataloged through the CVE system.
The study’s findings are illustrated by data showing that in many instances, exploit code appears publicly much sooner than the official CVE assignment. This phenomenon places a substantial burden on security teams, who must not only track software updates but also actively monitor for emerging exploit techniques and potentially unannounced vulnerabilities. The gap between a fix and a CVE can mean the difference between a protected system and a compromised one, especially in environments where rapid patching is not consistently enforced.
Broader Implications for Open-Source Software Security
The exploitation of CVE-2026-110447 within the Collabora CODE app for Nextcloud underscores the critical importance of robust security practices within the open-source ecosystem. While open-source software offers numerous benefits, including transparency and community-driven development, it also presents unique challenges in vulnerability management.
The reliance on community reporting and volunteer efforts for security patching, while often effective, can be subject to resource constraints and varying levels of urgency. The delay in formal CVE assignment, as highlighted by the Second Security study and corroborated by Collabora’s own explanation, points to systemic issues within the vulnerability disclosure and tracking infrastructure.
The increasing sophistication of threat actors, amplified by AI-driven tools, necessitates a more agile and responsive approach to vulnerability management. Organizations that rely on open-source components must implement proactive security measures, including:
- Continuous Monitoring: Implementing tools and processes to continuously monitor for new vulnerabilities, exploit code, and security advisories, even those that lack formal CVE identifiers.
- Proactive Patching: Establishing a rigorous patch management policy that prioritizes critical vulnerabilities and aims to deploy fixes as soon as they become available, rather than waiting for formal notifications.
- Supply Chain Security: Understanding the security posture of all software components within the supply chain, including third-party applications and libraries.
- Threat Intelligence: Subscribing to and actively utilizing threat intelligence feeds that can provide early warnings of emerging threats and exploitation trends.
The situation also calls for a re-evaluation of the current CVE assignment and publication processes. While the CVE system is a vital standard for vulnerability identification, its limitations in keeping pace with the speed of modern cyber threats are becoming increasingly apparent. Industry stakeholders, including vulnerability databases, software vendors, and security researchers, may need to collaborate on solutions that can accelerate the notification and dissemination of critical security information.
In conclusion, the exploitation of CVE-2026-110447 serves as a stark reminder of the persistent threats facing software systems, particularly in the open-source domain. The incident highlights the critical need for both vendors and users to remain vigilant, adapt to evolving threat landscapes, and ensure that security practices are not solely reliant on the formal announcement of vulnerabilities but also on proactive threat detection and rapid remediation. The ongoing race between defenders and attackers, now accelerated by artificial intelligence, demands a more dynamic and integrated approach to cybersecurity.
