A critical flaw exploited since September 2026

The CVE-2026-110447 flaw, rated critical with a CVSS 4.0 score of 9.2 according to OpenCVE, specifically affects the Built-in CODE Server module (called richdocumentscode) integrated into Collabora Online for Nextcloud. It enables OS command injection via the proxy.php endpoint when the CODE server is stopped, a common scenario after a reboot, update, or crash, as explained by BleepingComputer.

The attacks, documented as early as mid-September 2026, precede the official publication of security advisories by GitHub and Collabora. The vulnerability affects only installations integrated with Nextcloud: standalone Collabora Online servers (Docker, RPM/DEB, Nextcloud All-in-One) and external deployments remain unaffected, according to Rapid7.

Disabling the Collabora Online application integrated with Nextcloud is not sufficient for protection: webshells may persist, and attackers have been actively exploiting this flaw since September 2026.

Exploitation method: webshells and search for sensitive data

Threat actors send a malicious request to proxy.php, exploiting command injection to implant PHP webshells (files named shx.php), as reported by administrators cited by ThreatWire. These webshells are used to explore targeted systems, particularly to locate password databases, password manager artifacts (such as KeePass) and cryptocurrency wallets, according to BleepingComputer.

While rumors suggest exploitation by ransomware operators, no independent confirmation has been established to date. The vulnerability is distinct from a similar flaw (CVE-2025-66208) and does not appear on the CISA KEV list, despite its critical score.

Delay in communication and urgent recommendations

Collabora attributed the delay in the public announcement of the vulnerability to delays in processing CVEs by GitHub, overwhelmed by the growing volume of AI-assisted reports, as indicated by BleepingComputer. A community warning was published on October 3, 2026, urging administrators to update immediately to version 26.4.303 or a newer patched version, fixed on September 11.

Nextcloud emphasized that Collabora had reported the vulnerability as early as mid-September and that users had a window to apply the fix via the app store. However, the company specifies that it has not observed widespread exploitation, although isolated cases have been reported. Collabora insists: disabling the application is not sufficient to protect against the threat, and suspicious PHP files must be manually removed.

What this means here: risks for administrations and businesses in the sub-region

Beninese and West African organizations using Nextcloud with the integrated Collabora Online application (particularly for collaborative environments or online documents) could see their servers compromised if they have not applied the 26.4.303 update. Targeted exploitation of webshells exposes locally stored sensitive data, such as passwords or digital wallets, to leaks or malicious use.

Public administrations, banks, and private-sector companies using internal cloud storage solutions based on Nextcloud should check the status of the integrated CODE server and apply the fix without delay, especially after a reboot or maintenance. Increased monitoring of suspicious PHP files (shx.php) in critical directories is also recommended to detect intrusions.

Actors using standalone deployments of Collabora Online (outside Nextcloud) or Docker/RPM/DEB versions are not affected by this vulnerability, but they could be targeted by other vulnerabilities. Regular configuration reviews and application updates remain essential practices to mitigate risks.