PolicyCortex
Request Access
Summary
  • CISA added the flaw to the KEV catalog on October 23, 2026, with a federal due date of October 26.
  • The record is CVE-2026-110447, scored CVSS 4.0 9.2, which is critical.
  • Versions of the richdocumentscode app before 26.4.303 are affected.
  • Attackers used the flaw to drop web shells on real Nextcloud servers in September and October.
  • Standalone Collabora Online servers are not affected.

The three day clock

The Cybersecurity and Infrastructure Security Agency (CISA) keeps a public warning list. The list is the Known Exploited Vulnerabilities (KEV) catalog. A KEV listing means the flaw is under active attack in the real world.

CISA added CVE-2026-110447 to the catalog on October 23, 2026. Common Vulnerabilities and Exposures (CVE) is the public record system. The federal remediation due date is October 26, 2026. That is three days from listing to deadline.

Private teams do not get a federal order. They get the same risk. An exploited flaw does not wait for a maintenance window.

What the flaw does

Collabora Online is an office suite that runs inside Nextcloud. The Built-in CODE Server is a Nextcloud app that starts it. The app is called richdocumentscode.

Versions before 26.4.303 carry the flaw. The weak point is proxy.php, which restarts the built in server. When the CODE server is not running, proxy.php fails open. It passes input to an operating system command. That is OS command injection, weakness CWE-78.

An attacker with no account can reach it. The result is remote code execution. RCE means remote code execution. A stranger runs code on the server.

The CVE record scores it CVSS 4.0 9.2. The Common Vulnerability Scoring System (CVSS) is the severity scale. A 9.2 is critical.

Standalone Collabora Online servers are not affected. Only this app deployment is. Docker installs, Linux packages, and hosted Collabora are clear of this one.

Exploited since September

The record states exploitation in the wild in September and October 2026. A Nextcloud forum notice from October 3, 2026 warned admins to update. Users found web shells on their servers.

One reported shell was named Nx_33143.php. It sat in the richdocumentscode app folder. It held a one line backdoor. The lesson is blunt. Patching closes the door. It does not remove a shell already inside.

The governance lesson

Flaw remediation is a basic control family. NIST 800-53 calls it SI-2. NIST 800-171 calls it 3.14.1. Both require flaws to be fixed in a defined window. The KEV clock shows what a real window looks like.

Patch day evidence should answer four questions. What version ran before the patch. What version runs now. When the restart happened. What the log review found.

The log review is the part teams skip. For this flaw, check for unknown PHP files in the app folder. Review access logs back to early September for proxy.php hits. A clean scan after patching proves the fix. Only the hunt proves the box was never owned.

If covered defense information sat on the server, a confirmed shell starts a reporting clock. DFARS 252.204-7012 requires rapid reporting of a cyber incident. That clock is 72 hours from discovery.

PolicyCortex does not patch Nextcloud apps or clean web shells. Vendors and server admins do that work. PolicyCortex helps teams collect the evidence that the fix landed and the review found nothing.

One ask

Update the richdocumentscode app to 26.4.303 today. Hunt for dropped web shells before you mark the ticket closed.

Sources

Questions on this record
What is the federal deadline for this flaw?
CISA added CVE-2026-110447 to the KEV catalog on October 23, 2026. Federal agencies must remediate it by October 26, 2026.
How do I know if my server was hit?
Look for unknown PHP files in the richdocumentscode app folder. Review access logs for proxy.php hits back to early September. Patching alone does not remove a web shell.
Does PolicyCortex patch Nextcloud?
No. Vendors and server admins apply the fix. PolicyCortex helps teams collect the evidence that the fix landed and the logs show no prior use.

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.

proof.state
Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change
Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency
Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture
Architecture. How the chain is built and where it lives: inside your tenant, with no egress of evidence.

Further reading in this register

  1. Two Okta Access Gateway Flaws, One Admin Console: Upgrade to 2026.10.2Okta published two Access Gateway advisories on October 22, 2026. One lets a signed-in user reach the admin console. The other lets an admin run system commands. Both are fixed in 2026.10.2.5 min
  2. One Shared Atlassian Component Let Attackers Read Server Files With No LoginCVE-2026-21589 gives unauthenticated arbitrary file access in eight Atlassian Data Center products through one shared component. CISA added it to the KEV catalog on October 15, 2026. Public proof of concept code exists, and decoy servers saw attacks within about two hours of the advisory.6 min
  3. Root Without a Login: Cisco Expressway and Unified CM Hardening FixesCisco published October hardening releases on October 21, 2026. The worst flaw gives an unauthenticated remote attacker root on clustered Expressway. Two more 9.8 flaws hit Unified CM. No workarounds exist.6 min

Verify the record this entry describes.

Request AccessBook a call
Published
Last updated
Unchanged since publication
Author
Leonard Esere