Key points
- The flaw allows remote code execution in Collabora Online Built-in CODE Server versions before 26.4.303.
- Exploitation occurred in the wild during September and October 2026, targeting systems when the server was not running.
- The vulnerability is rated Critical with a CVSS score of 9.2 and is distinct from CVE-2025-66208.
Attackers achieved full remote code execution on Nextcloud instances using the Collabora Online Built-in CODE Server. This capability allows them to run arbitrary operating system commands on the host machine. The exploit succeeded because the server component was inactive, such as immediately after a system restart. This specific weakness affects only the built-in deployment mode, not standalone Collabora servers.
In plain English
The vulnerability exists in a file called proxy.php within the Collabora Online application. When the main CODE server process is down, this file fails to properly validate incoming requests. An attacker can send specially crafted input that the system interprets as operating system instructions. This bypasses normal application boundaries, allowing the attacker to execute commands directly on the server operating system.
The background
According to the National Vulnerability Database, this issue is tracked as CVE-2026-110447. It affects Collabora Online Built-in CODE Server versions prior to 26.4.303. Researchers confirmed active exploitation in the wild during September and October 2026. The flaw is classified as an OS command injection under CWE-78. It is a separate issue from the previously reported CVE-2025-66208.
What changes now
Organisations using the affected built-in server configuration are at immediate risk. The vulnerability is present in versions before 26.4.303. Users of standalone Collabora Online servers are not affected by this specific flaw. Administrators must verify their deployment type and version number. If the built-in server is in use, upgrading to version 26.4.303 or later is required to resolve the issue.
The attacker's path
Teams usually monitor for indicators of compromise related to command injection. This technique often serves as an initial access vector or a privilege escalation step. Check whether your logging systems capture unusual process spawns or network connections originating from web application components. Verify that input validation controls are functioning correctly on all public-facing endpoints. Ensure that server restart procedures include checks for pending security patches before services become fully available.
What to do and how to stay safe: Collabora Online
- Verify if your Nextcloud instance uses the built-in Collabora CODE Server rather than a standalone deployment.
- Check the current version of the richdocumentscode app and compare it against the affected range before 26.4.303.
- Monitor server logs for unusual command execution or process creation during periods when services are restarting.
- Plan an upgrade to version 26.4.303 or later once the vendor provides the update to mitigate the risk.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is this vulnerability affecting all Collabora Online deployments?
No, only the Built-in CODE Server deployment is affected; standalone servers are not vulnerable to this specific flaw.
When was this vulnerability actively exploited?
Exploitation was observed in the wild during September and October 2026.
What version fixes this issue?
The issue is resolved in Collabora Online Built-in CODE Server version 26.4.303 and later.
