Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026–110447, in the Collabora Online — Built-in CODE Server app (richdocumentscode) for Nextcloud.

Multiple administrator reports indicate that attacks began in mid-September, roughly a month before the formal security bulletin, the GitHub advisory, and CVE publication.

CVE-2026–110447 impacts richdocumentscode versions before 26.4.303 and resides in the Nextcloud app’s mechanism for starting the bundled Collabora server.