The 30-Second Brief
- Source report CISA’s October 23 alert adds CVE-2026-110447 to its exploited-vulnerability catalog. The affected component is Nextcloud’s Collabora Online Built-in CODE Server app. [1]
- Analysis Check installed components, including disabled ones. A service that is currently stopped can still leave a vulnerable web-accessible path.
What Changed
Collabora’s October 14 advisory identifies unauthenticated operating-system command injection in richdocumentscode before 26.4.303. The command runs as the web-server user, and the vulnerable path works while the built-in server is not running. The vendor says disabling the app is insufficient: upgrade to 26.4.303 or later, or remove it. Standalone Collabora Online servers are not affected by this flaw. [2]
Why It Matters
Analysis The new exploitation signal changes the priority of an existing patch. Inventory should answer which app is installed, which version is on disk and whether requests can reach it. A dashboard showing a healthy document editor is only a snapshot; maintenance, failures and restarts can change the execution state. Assign the Nextcloud owner and the hosting owner a shared remediation record so each knows which component was actually checked.
Evidence & Uncertainty
Priority is Urgent for affected installations because CISA cites evidence of active exploitation. This does not prove that every vulnerable server is compromised. BriefSpire verified the vendor advisory and CISA’s indexed alert; direct retrieval of the CISA page returned 403. No exploit was executed. [1] [2]
Action Center
Selections remain in this browser.
Evidence Explorer
Does disabling the app close this issue?
Collabora explicitly says it does not. The prescribed options are upgrading or removing the affected app. [2]
What does a successful update establish?
Analysis: It establishes that the vulnerable version has been replaced. It does not establish whether an attacker previously changed files or accessed secrets; review that question separately.
What about older Nextcloud deployments?
The vendor directs users of end-of-life Nextcloud 29 or earlier to upgrade Nextcloud or remove this app. [2]
Sources & Transparency
Last source check: . Source claims are attributed; practical recommendations are BriefSpire analysis.
- CISA: exploited-vulnerability addition — October 23, 2026; indexed text verified.
- Collabora: official security advisory — October 14, 2026.