CVE-2026-110447

⚠️ ACTIVELY EXPLOITED — added to CISA KEV 2026-10-23 CVE-2026-110447: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability CVSS 9.8 · EPSS 1.2% · 2 public exploits Details, versions & intel → https://t.co/lvHIcBOBFR https://t.co/mG31bhJ4eX

🚨 KNOWN EXPLOIT — Collabora Online – Built-in CODE Server (CVE-2026-110447): an OS command injection flaw in Nextcloud allows remote code execution when the CODE server isn't running. Run it? Apply vendor mitigations now — CISA's deadline is Oct 26. Stay safe. @J3ss3s777

管理先のサーバーの1つがPHP本体じゃなくって、Nextcloudのcollabora関連の脆弱性CVE-2026-110447で先週のうちにマルウェアが設置されてしまい、sshログインをフックにして勝手にマイニングアプリ起動されててワロタ というかもうお腹痛い 他人事かと思ってたけどちょっとこれ流出監査案件で…

Urgent alert: CVE-2026-110447 is putting Nextcloud servers at risk. The built-in Collabora CODE flaw being exploited lets attackers run OS commands without login, via web shells. Systems using richdocumentscode 26.4.303 are vulnerable. Update or remove now, and inspect for PHP files or signs of com…

CVE-2026-110447: The Collabora Fix That Had No Name for 33 Days https://t.co/ZsJTocYWc6 via @YouTube

Unauthenticated command-injection (CVE-2026-110447) in Nextcloud's optional CODE server app has let attackers since mid-September plant webshells and hunt password databases, password-manager data, and crypto wallets. Patch to 26.4.303 or remove; then hunt and rotate. #Nextcloud https://t.co/v7Syny…

Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 since August, and attackers are actively backdooring Nextcloud servers via Collabora RCE CVE-2026-110447. #CyberSecurity #BlueTeam #ZeroDay https://t.co/WzB5XrT4zA

Nextcloud向けアプリ「richdocumentscode」に、認証不要でOSコマンドを実行される脆弱性があり、9月から悪用が報告されています。CVE-2026-110447は、同アプリのproxy[.]phpに細工したリクエストを送ると、Webサーバーの実行ユーザー権限でコマンドを実行される欠陥で、CVSSv4の値は9.2（緊急）。GitHubに寄せられた被害報告では、悪用されたサーバーに任意のコマンドを実行できるWebシェルが置かれ、パスワード管理ソフトのデータや暗号資産ウォレットのファイルを探す命令も実行されたとされています。攻撃が成立するのは組み込みのCODEサーバーが止まって…

🔐 Running Collabora's Built-in CODE Server app on Nextcloud? Update now. A critical flaw, CVE-2026-110447, was used to plant web shells. How many servers were hit is unknown. Update to 26.4.303 or remove the app. Source: Collabora / Nextcloud https://t.co/8TO63i59g7

#Nextcloud : une faille critique dans l'application #Collabora Built-in CODE (CVE-2026-110447) est exploitée depuis le 10 septembre pour déposer des webshells. Désactiver l'application ne suffit pas. Comment vous protéger : https://t.co/hPsiox5mPn https://t.co/RzFTFed0kr

GitHub cross-source: sstrobl-osm/php2shell-tools: Read-only triage tools for the October 2026 PHP remote-code-execution flaws: CVE-2026-109618 / CVE-2026-109619 / CVE-2026-110447

GitHub cross-source: Iceman2050/cve-2026-110447-checker: Free CLI: check a Nextcloud instance for CVE-2026-110447 exposure. Stdlib only, honest verdicts. By Ingenious AI.

GitHub cross-source: adriyansyah-mf/cve-2026-110447:

CVE-2026-110447 exploited to backdoor Nextcloud servers through Collabora CODE app — submitted by /u/sysadmin_diaries to r/cybersecurity [link] [comments]