Hackers Exploit Critical RCE Flaw in Collabora to Backdoor Nextcloud
Threat actors are actively exploiting a critical remote code execution vulnerability in the Collabora Online CODE Server app used by Nextcloud servers, enabling unauthorized system access and backdoors.
Why it matters
This actively exploited critical vulnerability poses a direct risk to Nextcloud infrastructures using Collabora, potentially allowing attackers to compromise affected servers and facilitate unauthorized access.
SOC impact
Defenders must monitor for exploitation attempts targeting the Collabora Online CODE Server, verify the presence of vulnerable instances in their environments, and investigate any related suspicious activity to detect backdoor deployments or unauthorized access.
Recommended actions
- Identify assets running the Collabora Online CODE Server application
- Monitor logs for indicators of exploitation targeting CVE-2026-110447
- Investigate unusual system modifications or new backdoor files
- Review Nextcloud server access logs for anomalous authentication or activity
- Correlate threat intelligence related to active exploitation campaigns
Executive Summary
A critical remote code execution vulnerability, tracked as CVE-2026-110447, in the Collabora Online CODE Server app integrated with Nextcloud servers is currently under active exploitation by threat actors. This flaw permits attackers to implant backdoors, granting unauthorized access to compromised systems. Operationally, this situation demands urgent identification of vulnerable deployments, rigorous monitoring for exploitation signs, and investigation into potential compromise. Maintaining awareness of this vulnerability’s exploitation aids defenders in preventing serious breaches within Nextcloud environments.
SOC Impact
Defenders must monitor for exploitation attempts targeting the Collabora Online CODE Server, verify the presence of vulnerable instances in their environments, and investigate any related suspicious activity to detect backdoor deployments or unauthorized access.
What SOC Teams Should Validate
- Identify assets running the Collabora Online CODE Server application
- Monitor logs for indicators of exploitation targeting CVE-2026-110447
- Investigate unusual system modifications or new backdoor files
- Review Nextcloud server access logs for anomalous authentication or activity
- Correlate threat intelligence related to active exploitation campaigns
Why It Matters
This actively exploited critical vulnerability poses a direct risk to Nextcloud infrastructures using Collabora, potentially allowing attackers to compromise affected servers and facilitate unauthorized access.