Cybersecurity news: CVE-2026-110447 is an unauthenticated command-injection flaw in Nextcloud, exploited in the wild — scans found 19,454 exposed instances. This 5-question quiz checks your version, exposure, and patch status.
CVE-2026-110447 is an unauthenticated command-injection flaw in Nextcloud, exploited in the wild — and scans found 19,454 exposed instances. If your server is unpatched and internet-facing, assume exposure. This 5-question quiz checks your version, exposure, and patch status, then tells you exactly what to do next.
CVE-2026-110447 is a critical Nextcloud vulnerability from 2026 — an unauthenticated command injection exploited in the wild, with tens of thousands of exposed instances found in internet scans.
Censys counts 19,454 hosts with the vulnerable Collabora app installed. Five honest questions, one honest Nextcloud CVE verdict — including the uncomfortable ones admins skip, like "was it vulnerable last month?" No signup, nothing leaves your browser.
1. Is the "Collabora Online – Built-in CODE Server" (richdocumentscode) app installed right now?
2. If installed: is its version below 26.4.303?
3. Is your Nextcloud reachable from the internet?
4. Was a vulnerable version (< 26.4.303) installed at any point during Sept–Oct 2026?
5. Is your Nextcloud version 29 or older?
sudo -u www-data php occ app:list | grep richdocumentscode
sudo -u www-data php occ --version
Two commands, ten seconds. The first tells you if the built-in CODE app is installed and its version; the second tells you your Nextcloud version (29 or older = end of life). Then retake the quiz.
Exposure figures: Censys advisory, Oct 16 2026 · Attack timeline: The Hacker News
The 34-day disclosure timeline · Check the EOL trap · 30-second exposure check
Censys reported on October 16, 2026 that it detects 19,454 hosts and 103,350 web properties with the vulnerable Collabora built-in CODE Server app installed. Only servers running richdocumentscode below 26.4.303 are actually exploitable.
An internal-only server is much harder to reach, but the flaw needs no authentication — anyone who can reach the server's proxy.php endpoint can exploit it. VPN-only or LAN-only deployments are lower risk, not zero risk.
Removing the app closes the hole going forward, but if a vulnerable version was installed any time in September–October 2026, you should still hunt for planted web shells (shx*.php / shrf*.php patterns) and review access logs from September 10 onward. Patching or removing never deletes shells.
Nextcloud itself remains safe to use when kept updated — the October 2026 incident was a critical flaw (CVE-2026-110447) in one optional app, the built-in Collabora CODE server, not in Nextcloud core. Stay on a supported release, apply maintenance updates promptly, and remove apps you do not use.
Check whether the ‘Collabora Online – Built-in CODE Server’ app (richdocumentscode) is installed and older than 26.4.303 — via Admin > Apps or ‘occ app:list’. If the app was present at any point in September–October 2026, assume exposure and hunt for web shells even after patching.
Take the server offline, restore from a clean backup or rebuild it, and rotate every credential the server touched. Hunt for leftover PHP web shells — patching CVE-2026-110447 does not remove shells attackers already planted — then update the Collabora app to 26.4.303+ or remove it.