CVE-2026-110447 is an unauthenticated OS command injection in the built-in CODE server that Nextcloud ships as the richdocumentscode app, scored 9.2 on CVSS v4.0 and filed as CWE-78. CISA added it to the Known Exploited Vulnerabilities catalogue on 23 October with a due date of 26 October, which is today.

The condition is the interesting part

Exploitation needs no account and no user interaction. It does need 1 condition: the built-in CODE server has to be stopped when the request arrives. The window opens when the service is down — after a crash, during an upgrade, or in the seconds after a restart — so an administrator bouncing the stack for an unrelated patch opens it themselves.

The longer the restart takes on a loaded server, the wider that window is. A flaw which fires while a service is unavailable is also a flaw that leaves very little in that service's own logs, because the service was not running to write them.

Disabling the app is not enough

The fix is the app at version 26.4.303 or later, or removing the app entirely. Disabling it does not close the hole, and that is the sentence worth carrying away, because disabling is the first thing most people do when they read a 9.2 with a 26 October deadline and cannot patch today. Here the thing that feels like a mitigation is not one, and the distinction is the whole advisory.

A separately operated Collabora server — the deployment where CODE runs as its own service rather than inside Nextcloud — is not affected. The vulnerability is specific to the bundled version.

Who is actually running this

Nextcloud's installed base is self-hosted by definition, and the built-in CODE server exists so that document editing works without standing up a second service. A flaw in that convenient option lands hardest on small teams, charities, schools and practices: the deployments with no second administrator and no maintenance window. The 26 October federal deadline reaches none of them.

The people who chose Nextcloud chose to keep their files off somebody else's platform, which is a defensible decision that comes with the bill for running the thing.

What was done with it

Public reports describe successful exploitation going back to September 2026, more than a month ahead of the catalogue listing. The post-exploitation is unglamorous and familiar: PHP webshells dropped on the server with filenames beginning shx, followed by searches for password databases and cryptocurrency wallet files.

Somebody is monetising file servers, which is what file servers are for.

That timeline is the part to act on. If you run this and you have not checked, the relevant question is not whether you are vulnerable today but whether you were vulnerable in September.

What to do

  • Update the app to 26.4.303 or later, or remove it. Disabling does not work.
  • Search the server for PHP files with names starting shx, and for any PHP file in a data or app directory with a recent modification time you cannot explain.
  • Check whether the deployment uses the built-in CODE server or a separate Collabora server. Only the first is affected.
  • Review access logs around any restart or upgrade since September, because those are the moments the condition was met.
  • If you find a webshell, rotate the credentials the server holds before you clean it. The reports describe searches for password databases, which is the point of the intrusion rather than a side effect.

What is not established

  • How many servers were reached. No count has been published.
  • Who is behind it. The behaviour suggests opportunistic monetisation rather than a named actor, and nobody has attributed it.
  • How exploitation began in September relative to the fix becoming available.
  • Whether the searches for wallet files succeeded anywhere.
  • Whether older Nextcloud releases can install a fixed version of the app at all. One account says they cannot, and we could not confirm it.
  • What share of affected installations are on the built-in server rather than a separate one.

Nextcloud's own advisory was not retrieved for this piece. The version numbers and the condition above come from the reporting of it.