--- title: "Collabora CODE Server KEV RCE: Patch by October 26" description: "CISA added a Collabora Built-in CODE Server flaw to the KEV list on October 23, 2026. It is a critical remote code execution flaw exploited since September." url: https://policycortex.com/blog/collabora-code-server-kev-rce sealed: 2026-10-24 register: blog/collabora-code-server-kev-rce records: 3 digest: sha3:b907747d02dcaf83e8710dd1ef687233d8778cd2358d5bc27fb809bb9fb528e4 --- # CISA Sets a Three Day Patch Clock on a Collabora RCE Resources / Blog CISA added CVE-2026-110447 to its KEV catalog on October 23, 2026. The Collabora Online Built-in CODE Server flaw lets an attacker run code on a Nextcloud server. Federal agencies must fix it by October 26. Leonard Esere · Sealed 2026-10-24 · Reading time 5 min Filed under: [CISA KEV](https://policycortex.com/blog/tags/cisa-kev), [Collabora](https://policycortex.com/blog/tags/collabora), [Nextcloud](https://policycortex.com/blog/tags/nextcloud), [flaw remediation](https://policycortex.com/blog/tags/flaw-remediation), [governance](https://policycortex.com/blog/tags/governance) **Summary** - CISA added the flaw to the KEV catalog on October 23, 2026, with a federal due date of October 26. - The record is CVE-2026-110447, scored CVSS 4.0 9.2, which is critical. - Versions of the richdocumentscode app before 26.4.303 are affected. - Attackers used the flaw to drop web shells on real Nextcloud servers in September and October. - Standalone Collabora Online servers are not affected. ## The three day clock The Cybersecurity and Infrastructure Security Agency (CISA) keeps a public warning list. The list is the Known Exploited Vulnerabilities (KEV) catalog. A KEV listing means the flaw is under active attack in the real world. CISA added [CVE-2026-110447](https://www.cve.org/CVERecord?id=CVE-2026-110447) to the catalog on October 23, 2026. Common Vulnerabilities and Exposures (CVE) is the public record system. The federal remediation due date is October 26, 2026. That is three days from listing to deadline. Private teams do not get a federal order. They get the same risk. An exploited flaw does not wait for a maintenance window. ## What the flaw does Collabora Online is an office suite that runs inside Nextcloud. The Built-in CODE Server is a Nextcloud app that starts it. The app is called richdocumentscode. Versions before 26.4.303 carry the flaw. The weak point is proxy.php, which restarts the built in server. When the CODE server is not running, proxy.php fails open. It passes input to an operating system command. That is OS command injection, weakness CWE-78. An attacker with no account can reach it. The result is remote code execution. RCE means remote code execution. A stranger runs code on the server. The CVE record scores it CVSS 4.0 9.2. The Common Vulnerability Scoring System (CVSS) is the severity scale. A 9.2 is critical. Standalone Collabora Online servers are not affected. Only this app deployment is. Docker installs, Linux packages, and hosted Collabora are clear of this one. ## Exploited since September The record states exploitation in the wild in September and October 2026. A Nextcloud forum notice from October 3, 2026 warned admins to update. Users found web shells on their servers. One reported shell was named Nx_33143.php. It sat in the richdocumentscode app folder. It held a one line backdoor. The lesson is blunt. Patching closes the door. It does not remove a shell already inside. ## The governance lesson Flaw remediation is a basic control family. NIST 800-53 calls it SI-2. NIST 800-171 calls it 3.14.1. Both require flaws to be fixed in a defined window. The KEV clock shows what a real window looks like. Patch day evidence should answer four questions. What version ran before the patch. What version runs now. When the restart happened. What the log review found. The log review is the part teams skip. For this flaw, check for unknown PHP files in the app folder. Review access logs back to early September for proxy.php hits. A clean scan after patching proves the fix. Only the hunt proves the box was never owned. If covered defense information sat on the server, a confirmed shell starts a reporting clock. DFARS 252.204-7012 requires rapid reporting of a cyber incident. That clock is 72 hours from discovery. PolicyCortex does not patch Nextcloud apps or clean web shells. Vendors and server admins do that work. PolicyCortex helps teams collect the evidence that the fix landed and the review found nothing. ## One ask Update the richdocumentscode app to 26.4.303 today. Hunt for dropped web shells before you mark the ticket closed. ## Sources - CVE record: [CVE-2026-110447](https://www.cve.org/CVERecord?id=CVE-2026-110447), cve.org. - NVD record: [CVE-2026-110447](https://nvd.nist.gov/vuln/detail/CVE-2026-110447), National Institute of Standards and Technology. - [CISA Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-110447), KEV listing, added October 23, 2026, due October 26, 2026. - GitHub Advisory [GHSA-f97p-r72q-64h2](https://github.com/advisories/GHSA-f97p-r72q-64h2), Collabora Online Built-in CODE Server. - Nextcloud community forum notice, "To Collabora Built-in User: Update ASAP," October 3, 2026. - Image: original diagram by PolicyCortex. **Questions on this record** **Q: What is the federal deadline for this flaw?** A: CISA added CVE-2026-110447 to the KEV catalog on October 23, 2026. Federal agencies must remediate it by October 26, 2026. **Q: How do I know if my server was hit?** A: Look for unknown PHP files in the richdocumentscode app folder. Review access logs for proxy.php hits back to early September. Patching alone does not remove a web shell. **Q: Does PolicyCortex patch Nextcloud?** A: No. Vendors and server admins apply the fix. PolicyCortex helps teams collect the evidence that the fix landed and the logs show no prior use. ## Related records Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page. - **proof.state**: [Proof of State](https://policycortex.com/proof/state). What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained. - **proof.change**: [Proof of Change](https://policycortex.com/proof/change). Who or what altered the environment, under what authority, with before and after state hashes. - **proof.agency**: [Proof of Agency](https://policycortex.com/proof/agency). What a machine was permitted to do before it acted, what it did, and what would have stopped it. - **architecture**: [Architecture](https://policycortex.com/architecture). How the chain is built and where it lives: inside your tenant, with no egress of evidence. ### Further reading in this register | Published | Entry | Reading | |---|---|---| | 2026-10-24 | [Two Okta Access Gateway Flaws, One Admin Console: Upgrade to 2026.10.2](https://policycortex.com/blog/okta-oag-admin-console-command-injection): Okta published two Access Gateway advisories on October 22, 2026. One lets a signed-in user reach the admin console. The other lets an admin run system commands. Both are fixed in 2026.10.2. | 5 min | | 2026-10-23 | [One Shared Atlassian Component Let Attackers Read Server Files With No Login](https://policycortex.com/blog/atlassian-data-center-file-read-kev): CVE-2026-21589 gives unauthenticated arbitrary file access in eight Atlassian Data Center products through one shared component. CISA added it to the KEV catalog on October 15, 2026. Public proof of concept code exists, and decoy servers saw attacks within about two hours of the advisory. | 6 min | | 2026-10-23 | [Root Without a Login: Cisco Expressway and Unified CM Hardening Fixes](https://policycortex.com/blog/cisco-expressway-98-rce-unauthenticated-root): Cisco published October hardening releases on October 21, 2026. The worst flaw gives an unauthenticated remote attacker root on clustered Expressway. Two more 9.8 flaws hit Unified CM. No workarounds exist. | 6 min | Verify the record this entry describes. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book) Dates of record - **Published**: 2026-10-24 - **Last updated**: Unchanged since sealing - **Author**: Leonard Esere - **Record**: https://policycortex.com/blog/collabora-code-server-kev-rce ## Register colophon | Seq | Label | SHA3-256 | Prev | |---|---|---|---| | REC 0000 | HEAD | 58f8bd27db61 | f0ea5ddb42fd | | REC 0001 | BODY | e7e14e9f0405 | 58f8bd27db61 | | REC 0002 | RELATED RECORDS | b907747d02dc | e7e14e9f0405 | Head sha3:b907747d02dcaf83e8710dd1ef687233d8778cd2358d5bc27fb809bb9fb528e4. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.