Hackers Exploit Collabora RCE Flaw to Backdoor Nextcloud Servers

Cybersecurity researchers have issued warnings about active exploitation targeting a critical command execution flaw in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. Tracked as CVE-2026-110447, the vulnerability is being leveraged by malicious actors to plant backdoors on vulnerable server instances.

According to BleepingComputer, this remote code execution (RCE) flaw allows attackers to bypass security controls and execute arbitrary system commands. Successful exploitation grants intruders unauthorized access to the underlying server infrastructure, compromising sensitive data stored within cloud environments.

Nextcloud and its companion productivity apps are widely deployed by enterprises and organizations globally for secure file sharing and collaboration. Consequently, critical flaws affecting core extensions present a significant risk, as attackers frequently scan for unpatched instances to breach corporate networks.

System administrators and IT professionals are strongly urged to audit their Nextcloud deployments and update the affected Collabora components to the latest patched versions immediately. Swift patch management is crucial to mitigate ongoing automated exploitation attempts and secure enterprise assets.

This incident underscores the continuous need for robust security monitoring, vulnerability management, and timely software updates when maintaining open-source cloud infrastructure and productivity tools.