Nextcloud on CuraSec

Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers

Fri, 16 Oct 2026 15:21:49 +0000

Engineer — Act: Active exploitation of CVE-2026-110447 in the richdocumentscode Nextcloud app with a public PoC means any self-hosted Nextcloud instance running the built-in CODE Server is at immediate risk of RCE and backdoor implantation; patch the richdocumentscode app to the latest fixed version now and audit server filesystem and process history for signs of post-exploitation activity.
SOC/IR — Act: With confirmed active exploitation leading to backdoor deployment, assume any Nextcloud server running richdocumentscode may already be compromised; sweep Nextcloud hosts for anomalous child processes from the CODE Server, unexpected outbound connections, and persistence mechanisms (cron, systemd units, webshells) established since this CVE’s disclosure window.
Leader — Skip
Signals: CVE-2026-110447 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub

Thu, 15 Oct 2026 15:35:13 +0000

Engineer — Act: Active exploitation confirmed with web shells planted on Nextcloud servers since at least September 10. If you run Nextcloud with the Collabora Online Built-in CODE Server app, audit for web shell files in the web root and disable or patch the plugin immediately.
SOC/IR — Act: Confirmed active exploitation with web shell deployment provides a concrete hunt target — sweep Nextcloud server logs for anomalous command execution spawned by the web server process dating back to September 10, and look for unauthorized files in Nextcloud’s web-accessible directories.
Leader — Plan: Active backdooring of Nextcloud deployments via an optional collaboration plugin is a real risk if the organization runs self-hosted Nextcloud — confirm with engineering whether this plugin is in use and that incident response is underway; not yet a board-level event.