Source: bleepingcomputer.com
Threat actors are actively exploiting a critical remote code execution vulnerability tracked as CVE-2026-110447 in the Collabora Online Built-in CODE Server (richdocumentscode) plugin for Nextcloud. The flaw allows attackers to execute arbitrary commands on affected servers. Successful exploitation enables threat actors to install backdoors on compromised Nextcloud instances. The vulnerability is present in the richdocumentscode app, which is widely used to provide document editing capabilities within Nextcloud deployments. Organizations running Nextcloud with the Collabora Online integration are at significant risk. The active exploitation makes this a high-priority issue requiring immediate patching or mitigation. Nextcloud server administrators should review their installations and apply available security updates as soon as possible.
