{"id":245525,"date":"2026-10-17T01:23:04","date_gmt":"2026-10-17T06:23:04","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/10\/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers"},"modified":"2026-10-17T01:23:04","modified_gmt":"2026-10-17T06:23:04","slug":"hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/10\/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers","title":{"rendered":"Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers.jpg\"><\/a><\/p>\n<p>Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026\u2013110447, in the Collabora Online \u2014 Built-in CODE Server app (richdocumentscode) for Nextcloud.<\/p>\n<p>Multiple administrator reports indicate that attacks began in mid-September, roughly a month before the formal <a href=\"https:\/\/github.com\/CollaboraOnline\/online\/security\/advisories\/GHSA-g3vx-3m76-fghh\" rel=\"nofollow noopener\" target=\"_blank\">security bulletin<\/a>, the <a href=\"https:\/\/github.com\/advisories\/GHSA-f97p-r72q-64h2\" rel=\"nofollow noopener\" target=\"_blank\">GitHub advisory<\/a>, and <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2026-110447\" rel=\"nofollow noopener\" target=\"_blank\">CVE publication<\/a>.<\/p>\n<p>CVE-2026\u2013110447 impacts richdocumentscode versions before 26.4.303 and resides in the Nextcloud app\u2019s mechanism for starting the bundled Collabora server.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026\u2013110447, in the Collabora Online \u2014 Built-in CODE Server app (richdocumentscode) for Nextcloud. Multiple administrator reports indicate that attacks began in mid-September, roughly a month before the formal security bulletin, the GitHub advisory, and CVE publication. CVE-2026\u2013110447 impacts richdocumentscode versions before 26.4.303 and [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1492],"tags":[],"class_list":["post-245525","post","type-post","status-publish","format-standard","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/245525","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=245525"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/245525\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=245525"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=245525"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=245525"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}