tag: Nextcloud · 2 items
- Engineer — Act: Active exploitation of CVE-2026-110447 in the richdocumentscode Nextcloud app with a public PoC means any self-hosted Nextcloud instance running the built-in CODE Server is at immediate risk of RCE and backdoor implantation; patch the richdocumentscode app to the latest fixed version now and audit server filesystem and process history for signs of post-exploitation activity.
- SOC/IR — Act: With confirmed active exploitation leading to backdoor deployment, assume any Nextcloud server running richdocumentscode may already be compromised; sweep Nextcloud hosts for anomalous child processes from the CODE Server, unexpected outbound connections, and persistence mechanisms (cron, systemd units, webshells) established since this CVE’s disclosure window.
- Leader — Skip
- Signals: CVE-2026-110447 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Active exploitation confirmed with web shells planted on Nextcloud servers since at least September 10. If you run Nextcloud with the Collabora Online Built-in CODE Server app, audit for web shell files in the web root and disable or patch the plugin immediately.
- SOC/IR — Act: Confirmed active exploitation with web shell deployment provides a concrete hunt target — sweep Nextcloud server logs for anomalous command execution spawned by the web server process dating back to September 10, and look for unauthorized files in Nextcloud’s web-accessible directories.
- Leader — Plan: Active backdooring of Nextcloud deployments via an optional collaboration plugin is a real risk if the organization runs self-hosted Nextcloud — confirm with engineering whether this plugin is in use and that incident response is underway; not yet a board-level event.