CISA Sets October 26 Deadline for Exploited Nextcloud CODE Server Flaw

The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-110447 to its Known Exploited Vulnerabilities (KEV) catalog on October 23, 2026, setting an October 26 remediation deadline for federal agencies. The vulnerability is an unauthenticated operating-system command-injection flaw with a reported CVSS v4.0 score of 9.2. Reporting indicates attackers exploited vulnerable servers in September and October, making the issue an immediate operational concern rather than a routine patching item. The short interval between CISA’s listing and the deadline puts pressure on agency security teams and the contractors that operate, maintain, or assess their systems.

Exposure is narrower than the broad label “Nextcloud vulnerability” might imply. The flaw is in proxy.php within the richdocumentscode app, identified by Nextcloud as “Collabora Online – Built-in CODE Server.” It affects versions earlier than 26.4.303, and exploitation depends on the local CODE server not running—a condition that may occur during a restart, upgrade, or crash. Plain Nextcloud installations without the optional built-in app are not implicated by the reported scope, nor are standalone Collabora Online deployments. Collabora has described the built-in app as aimed at home users and noted it is not its recommended office-suite installation method.

The remediation timeline began before CISA’s KEV action: the fixed Built-in CODE Server release, version 26.4.303, reportedly shipped on September 11, 2026, with a requirement for Nextcloud 30 or later. Public reporting and the advisory followed on October 14, and CISA added the CVE to KEV on October 23. This sequence means agencies and service providers may already have had access to a fix, but the federal deadline makes confirmation and documentation urgent. Agencies should establish whether the affected app is installed, confirm its version and platform, and update it or remove it if it is not needed.

For GovCon teams, the practical task is targeted asset validation, not blanket treatment of every Nextcloud or Collabora environment as exposed. Contractors supporting federal networks should check configuration inventories, managed service environments, and customer-hosted deployments for the optional app and vulnerable version. Where exposure is confirmed, they should coordinate remediation with the agency, preserve relevant logs, and assist with investigation for signs of compromise. Procurement and IT leads can use the deployment-specific criteria to focus vulnerability assessments and service-provider requests, while documenting exceptions where the affected app is absent or the deployment is reported unaffected.

• CISA listed CVE-2026-110447 in KEV on October 23, 2026; federal remediation is due October 26, 2026.
• The flaw is unauthenticated OS command injection, rated CVSS v4.0 9.2.
• Affected software is the optional Nextcloud richdocumentscode Built-in CODE Server app below version 26.4.303.
• The vulnerable code is in proxy.php; the reported exploit condition is when the local CODE server is not running, such as during a restart, upgrade, or crash.
• The fixed release 26.4.303 reportedly shipped September 11, 2026, and requires Nextcloud 30 or later.
• Reporting says attackers used the flaw against live servers in September and October, supporting prompt exposure checks and compromise investigation.
• Standalone Collabora deployments, Docker images, RPM and DEB packages, and Nextcloud All-in-One images are reported unaffected.
• Contractors should verify app presence and version in systems they operate or support, then coordinate an update or removal with agency customers.
• Agencies and vendors should scope assessments to the vulnerable built-in app rather than treating all Nextcloud or Collabora installations as exposed.
• The issue is also tracked in the EU vulnerability database as EUVD-2026-100780.