Collabora built-in CODE on KEV: Nextcloud office apps and the restart window

On 23 Oct 2026, CISA added CVE-2026-110447 to the Known Exploited Vulnerabilities catalog: OS command injection in Collabora Online – Built-in CODE Server. CISA marks forensic triage required under BOD 26-04.

This is not “Collabora Online everywhere.” The vulnerable piece is the Nextcloud app commonly listed as Collabora Online - Built-in CODE Server (package richdocumentscode) — the optional path that downloads and runs a bundled CODE AppImage on the Nextcloud host. Public writeups and the CVE description agree: standalone Collabora Online servers are not affected; the built-in deployment is.

Use vendor / CISA pages for fixed versions. This post is engagement sequencing.

Snapshot

The interesting operator detail is the window: the dangerous code path runs when status/start logic decides the local office server must be launched. After a reboot or PHP-FPM recycle, the first unauthenticated proxy.php?status-style request can win.

Why this shows up on authorized engagements

Nextcloud + “office in the browser” is common on internal file shares and small-team self-host. On assessment:

• Finding Nextcloud ≠ finding Built-in CODE. Confirm whether richdocumentscode is installed, not only richdocuments pointing at an external Collabora.
• “Non-production / personal use” store wording does not mean absent from corporate perimeters.
• Patch day without hunt misses the point of KEV + BOD-shaped triage: exploitation predates broad awareness.

Triage questions

1. In ROE? File sync / Nextcloud / collaboration stack authorized?
2. Which office path? Built-in CODE app vs external Collabora (Docker/package/hosted) vs Nextcloud Office only?
3. Version? richdocumentscode below 26.4.303?
4. Already restarted recently? The precondition is “CODE not listening” — timing matters for proof and for hunt windows.
5. What do you pause? Do not drop unfinished AD/web paths because a new KEV named Collabora.

Operator path

Evidence worth capturing

• App list: richdocumentscode present, version string, Nextcloud major version (EOL Nextcloud lines may still be served vulnerable builds — upgrade platform or remove app)
• Reachability of .../apps/richdocumentscode/proxy.php (and ?status) without auth
• Access logs back through at least early September 2026 (public reports cite exploitation from ~10 Sep): requests whose path contains %2e%2e, $(, or ${IFS} around proxy.php?status
• Unexpected PHP under apps/richdocumentscode (reports cite shx*.php-style webshells) and other webroot drops
• Web-server account sudo / unexpected child processes after restart windows

Remediation order (client-facing, short)

1. Upgrade richdocumentscode to ≥ 26.4.303 or remove the app. Disabling is not enough.
2. On Nextcloud versions that cannot take the fixed app: upgrade Nextcloud or remove Built-in CODE.
3. Prefer architecture that does not need the built-in AppImage on production hosts (external Collabora) if that matches the client’s model.
4. Hunt webshells and log IoCs even if already patched — KEV implies prior exploitation risk.

What not to write

• “All Collabora Online is RCE” — standalone servers are out of scope per CVE text.
• Treating disable-as-mitigation as complete.
• Invented post-exploitation without filesystem/log evidence.
• Completeness claims without confirming which office deployment path exists.

Primary sources: CISA KEV alert, CVE-2026-110447, and contemporaneous reporting such as The Hacker News summary. Re-verify fixed versions on Collabora/Nextcloud channels before you file.