Key figure: The global average cost of a data breach was $4.44 million in 2025 (IBM, Cost of a Data Breach Report 2025).
This cybersecurity news checker answers one question: is Nextcloud safe in 2026? It tracks CVE-2026-110447 and related Nextcloud flaws, explains what each lets attackers do, and gives exact patch steps.
It covers the critical Nextcloud vulnerabilities disclosed in 2026, starting with CVE-2026-110447 in the Collabora built-in CODE server. For each flaw you get the attack scenario in plain language, who is affected, and the exact patch or mitigation step — no security background required.
Straight answers on the biggest Nextcloud CVE of 2026 — no panic. A critical flaw in one optional Nextcloud app was exploited against real servers in September and October 2026. Here is what happened, whether you are affected, and exactly what to do.
Nextcloud itself remains actively maintained, but in 2026 a critical vulnerability (CVE-2026-110447) in the optional “Collabora Online – Built-in CODE Server” app allowed unauthenticated remote code execution and was exploited in the wild. If you keep Nextcloud and its apps updated — the fix is richdocumentscode 26.4.303 or newer — and follow the compromise checklist after any exposure window, a self-hosted Nextcloud is as safe as any maintained platform.
An operating-system command-injection flaw in the built-in Collabora CODE server's proxy.php. When the app's local document server is not running — for example during a restart or upgrade — an unauthenticated request can execute OS commands as the web server user. Attackers planted PHP web shells on real servers and searched them for credential stores and crypto wallets. The fix was released September 11, 2026; the CVE advisory followed October 14, 2026.
Only if you have the “Collabora Online – Built-in CODE Server” (richdocumentscode) app installed at a version below 26.4.303. Standalone Collabora Online servers — Docker, Linux package, or hosted — are not affected. Check yours:
sudo -u www-data php occ app:list | grep richdocumentscode
shx*.php). Review web logs from September 2026 onward for requests to proxy.php.The full self-test walks you through the exact commands, step by step. No signup, nothing installed.
Nextcloud itself remains actively maintained, but in 2026 a critical vulnerability (CVE-2026-110447) in the optional 'Collabora Online - Built-in CODE Server' app allowed unauthenticated remote code execution and was exploited in the wild. If you keep Nextcloud and its apps updated — the fix is richdocumentscode 26.4.303 or newer — and follow the compromise checklist after any exposure window, a self-hosted Nextcloud is as safe as any maintained platform.
First, take the server offline or block external access. Check for web shells: search your Nextcloud app directories for PHP files you did not install (attackers used names like shx*.php), and review web logs from September 2026 onward for requests to proxy.php. Update the Collabora CODE app to 26.4.303+ or remove it — disabling alone does not fix it. Then rotate every secret the web server account could read: passwords, API keys, and database credentials.
No. Collabora's advisory is explicit: disabling the 'Collabora Online - Built-in CODE Server' app does not remove the vulnerable code path. You must update to version 26.4.303 or newer, or fully remove the app. This is the single most common mistake admins are making.
Run: sudo -u www-data php occ app:list | grep richdocumentscode. If the built-in CODE server app is installed and below version 26.4.303, you are exposed. Standalone Collabora Online servers are not affected — only the built-in app deployment.