The October 2026 Nextcloud patch sprint is the month admins had to ship the critical Collabora CODE fix for CVE-2026-110447 alongside three Hub 26 maintenance updates. This cybersecurity news planner puts them in the right order so one maintenance window covers both.
— Ingenious AI security check.
The Collabora CODE fix goes first — CVE-2026-110447 was exploited in the wild, so it outranks routine maintenance. Patch Collabora, verify the fixed build, then roll the three Hub 26 updates in the same window. Doing them in the wrong order wastes the maintenance window and leaves the exploited flaw open longer.
A sequenced checklist that puts security fixes in the right order — here, the exploited Collabora CODE flaw before routine Hub 26 maintenance — so one maintenance window covers everything.
October handed Nextcloud admins two jobs at once: the critical Collabora CODE fix (CVE-2026-110447, exploited in the wild) and three Hub 26 maintenance updates. Do them in the wrong order and you waste a maintenance window — or worse, patch the Hub while the RCE is still open. One checklist, right order, progress tracked — your Nextcloud CVE patch plan.
Maintenance updates: help.nextcloud.com · nextcloud.com blog · CVE-2026-110447: The Hacker News · Censys
Per the October 16, 2026 announcement: Nextcloud Hub 26 Winter updates to 33.0.10, Spring to 34.0.5, and Summer to 35.0.2. They include bug fixes, stability and security upgrades. The rollout is staged, starting at 30% of instances.
Triage the critical one first: the built-in Collabora CODE Server app (CVE-2026-110447, exploited in the wild) should be updated to 26.4.303+ or removed before anything else. Then apply your Hub maintenance update. If you're on Nextcloud 29 or older, there is no safe app version — upgrade Nextcloud or remove the app.
Probably not. Nextcloud rolls out maintenance updates in stages, starting at 30% of instances, so yours may simply not be in the first wave. Don't force it by switching to beta channels; wait for your wave or update manually from a backup.
Nextcloud itself remains safe to use when kept updated — the October 2026 incident was a critical flaw (CVE-2026-110447) in one optional app, the built-in Collabora CODE server, not in Nextcloud core. Stay on a supported release, apply maintenance updates promptly, and remove apps you do not use.
Check whether the ‘Collabora Online – Built-in CODE Server’ app (richdocumentscode) is installed and older than 26.4.303 — via Admin > Apps or ‘occ app:list’. If the app was present at any point in September–October 2026, assume exposure and hunt for web shells even after patching.
Take the server offline, restore from a clean backup or rebuild it, and rotate every credential the server touched. Hunt for leftover PHP web shells — patching CVE-2026-110447 does not remove shells attackers already planted — then update the Collabora app to 26.4.303+ or remove it.