---
title: 'Collabora Online built-in CODE Server flaw exploited in the wild; update to 26.4.303'
url: 'https://securteksecurity.com/news/collabora-code-server-flaw-cve-2026-110447-exploited'
markdown: 'https://securteksecurity.com/news/collabora-code-server-flaw-cve-2026-110447-exploited.md'
date: '2026-10-14'
description: 'CVE-2026-110447 is an OS command injection in proxy.php in the Collabora Online built-in CODE Server (the Nextcloud richdocumentscode app) before version 26.4.303. The CVE record states it was exploited in the wild in September and October 2026; webshells have been reported. Standalone Collabora On…'
taxonomy:
  category:
    - Cybersecurity
---

# [Collabora Online built-in CODE Server flaw exploited in the wild; update to 26.4.303](https://securteksecurity.com/news/collabora-code-server-flaw-cve-2026-110447-exploited)

   14th Oct 2026  

CVE-2026-110447 is an OS command injection in proxy.php in the Collabora Online built-in CODE Server (the Nextcloud richdocumentscode app) before version 26.4.303. The CVE record states it was exploited in the wild in September and October 2026; webshells have been reported. Standalone Collabora Online servers are not affected.

Update, October 15: BleepingComputer and The Hacker News reported new detail on the exploitation. Attackers sent unauthenticated requests to the proxy.php endpoint when the built-in CODE server was stopped, for example after a restart, upgrade, or crash, and planted PHP webshells that were used to search for password databases, password manager files, and cryptocurrency wallets. At least three administrators reported attacks dating back to September 10; no root access was reported, and the total number of affected servers is unknown. Administrators should update to 26.4.303 or later or remove the app; disabling the app alone is not sufficient, and any webshell already planted must be removed separately.

Update, October 23: CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog on October 23, 2026, based on evidence of active exploitation, with a federal remediation due date of October 26, 2026. Carthage Electronics, reporting both October 23 KEV additions, puts the catalog at version 2026.10.23 with 1,756 entries and notes that Censys counted 19,454 hosts with the app installed on October 16. The KEV listing moves this item from the SIGNIFICANT band to the CRITICAL band under the page rubric, which treats a CISA KEV listing as Critical. The update advice is unchanged: update to 26.4.303 or later or remove the app, and check for webshells planted since September 10 before cleaning.

Sources: [CVE record](https://www.cve.org/CVERecord); [NVD](https://nvd.nist.gov/vuln/detail/cve-2026-110447); [BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/); [The Hacker News](http://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html); [CISA](https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog-0); [Carthage Electronics](https://carthageelectronics.com/october-23-2026-cve-threat-brief/)

---

## Navigation

- Parent: [News](https://securteksecurity.com/news.md)
- Previous: [CoinDCX confirms $16 million loss from retired wallets compromised in its 2025 hack](https://securteksecurity.com/news/coindcx-confirms-16-million-loss-retired-wallets.md)
- Next: [Colorado replacement AI law reaches its rulemaking deadline](https://securteksecurity.com/news/colorado-sb-26-189-ai-rulemaking-deadline.md)