CVE-2026-110447: Critical Collabora Online RCE in Nextcloud Under Active Exploitation — Detection and Remediation Guide | Security Arsenal

Threat actors are actively exploiting CVE-2026-110447, a critical remote command execution vulnerability in the Collabora Online – Built-in CODE Server app (richdocumentscode) for Nextcloud, to gain unauthorized access and plant backdoors on exposed Nextcloud servers. This is not a theoretical risk — exploitation is confirmed in the wild, and the attack path leads directly to code execution on the underlying host under the web service account.

This matters more than the average app bug for three reasons. First, richdocumentscode is the built-in CODE server — the frictionless option admins install to get document editing working without standing up a separate Collabora server. It is common on small-to-midsize deployments, homelab-to-production migrations, and exactly the kind of under-maintained instances attackers scan for. Second, Nextcloud servers almost always hold sensitive data: files, credentials in config, calendar and contact data, and frequently live adjacent to internal networks. Third, the web service account (www-data, apache, or nginx depending on distro) is a beachhead — attackers use it to drop web shells, harvest secrets, and pivot.

If you run Nextcloud with the Built-in CODE Server app enabled, treat this as a patch-and-hunt event, not a patch-only event. Assume compromise until your hunt says otherwise.

Technical Analysis

Affected Component

Product: Collabora Online – Built-in CODE Server (richdocumentscode), an app distributed through the Nextcloud app store
Vulnerability class: Remote command execution in the CODE server component bundled with the app
Identifier: CVE-2026-110447 (rated critical by the vendor; check the vendor advisory for the authoritative CVSS vector)
Impact: Unauthenticated or low-friction remote attackers can execute arbitrary operating system commands on the Nextcloud host in the context of the web server process
Host platforms: Overwhelmingly Linux (Debian/Ubuntu/RHEL-family), commonly Apache or nginx with PHP-FPM

How the Attack Works — Defender's View

The richdocumentscode app embeds a Collabora Online Development Edition (CODE) server inside the Nextcloud app directory and proxies document-editing traffic to it. The flaw allows a remote attacker to reach the CODE server component and coerce it into executing operating system commands. From a detection standpoint, the exploitation chain produces a very recognizable behavioral signature:

Inbound request to Nextcloud endpoints associated with the richdocuments/CODE proxy path (look for requests to routes under /apps/richdocumentscode/ and /index.php/apps/richdocuments/).
Command execution — the CODE server process (coolwsd and its children) or the PHP-FPM/Apache worker spawns an unexpected shell (sh, bash, dash) running tooling such as curl, wget, chmod, id, uname, or base64-decoded payloads. A document-conversion daemon spawning a shell is the single highest-fidelity signal in this campaign.
Backdoor deployment — observed post-exploitation tradecraft in this campaign includes writing PHP web shells into web-accessible directories (the Nextcloud app tree, data/ subdirectories exposed via misconfig, or upload paths), adding cron entries, and in some cases appending attacker SSH keys to authorized_keys for persistence beyond the web context.
Secondary access — attackers return through the web shell rather than re-exploiting, so patching alone does not evict them.

Exploitation Status

Actively exploited in the wild — threat actors are using this flaw to backdoor Nextcloud servers, per the reporting linked below.
Public scanning for vulnerable Nextcloud/CODE endpoints should be assumed. Any internet-facing instance running a vulnerable richdocumentscode build should be treated as potentially compromised.
At time of writing, defenders should monitor CISA's Known Exploited Vulnerabilities catalog for a potential KEV listing, which would trigger binding remediation deadlines for federal civilian agencies and is a strong prioritization signal for everyone else.

Detection & Response

The detections below target the two things attackers cannot avoid: the CODE/web server process spawning shells, and the artifacts of the backdoors they deploy (new PHP files in web-accessible paths, cron persistence, SSH key injection). These are technique-based, so they retain value even as attacker payloads rotate.

Sigma Rules

YAML

---
title: Collabora CODE Server or PHP-FPM Spawning Shell on Nextcloud Host
id: 3f8c2a91-4b7e-4d1a-9c52-7e6f1a0b9d34
status: experimental
description: Detects the Collabora CODE server (coolwsd) or PHP-FPM/Apache workers spawning command shells or download tooling, consistent with exploitation of CVE-2026-110447 in richdocumentscode.
references:
  - https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - 'coolwsd'
      - 'php-fpm'
      - '/apache2'
      - '/httpd'
      - '/nginx'
  selection_child_img:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/base64'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child_img
falsepositives:
  - Rare administrative scripts invoked through Nextcloud app workflows; validate against change windows
level: critical
---
title: PHP Webshell Written to Nextcloud Application or Data Directory
id: 9d1e4b27-6c3f-4a58-b8e2-2f7c0d5a1e96
status: experimental
description: Detects creation or modification of PHP files in Nextcloud app, data, or upload paths by the web service account — a common backdoor artifact following richdocumentscode exploitation (CVE-2026-110447).
references:
  - https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/nextcloud/apps/'
      - '/nextcloud/data/'
      - '/var/www/html/apps/'
      - '/var/www/nextcloud/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
  filter_known_updates:
    TargetFilename|contains:
      - '/nextcloud/ updater'
  condition: selection_path and selection_ext and not filter_known_updates
falsepositives:
  - Legitimate Nextcloud app installs and updates via occ or the web updater; correlate with admin activity
level: high
---
title: Persistence via Cron or Authorized Keys by Web Service Account
id: 5a7b9c13-8e2d-4f6a-a1c9-4b3d8e6f2a71
status: experimental
description: Detects the web service account (www-data/apache/nginx) writing cron entries or modifying authorized_keys, a persistence pattern observed in Nextcloud server backdooring campaigns.
references:
  - https://attack.mitre.org/techniques/T1053/003/
  - https://attack.mitre.org/techniques/T1098/004/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1053.003
  - attack.t1098.004
logsource:
  category: file_event
  product: linux
detection:
  selection_target:
    TargetFilename|contains:
      - '/etc/crontab'
      - '/etc/cron.d/'
      - '/var/spool/cron/'
      - '/.ssh/authorized_keys'
  selection_user:
    User|contains:
      - 'www-data'
      - 'apache'
      - 'nginx'
      - 'http'
  condition: selection_target and selection_user
falsepositives:
  - None expected; the web account should never modify these paths in normal operation
level: critical

KQL (Microsoft Sentinel)

Assumes Linux Syslog (with Sysmon for Linux or auditd process telemetry) is ingested into the Syslog table. This hunts the parent/child process anomaly at the heart of the exploitation chain.

KQL — Microsoft Sentinel / Defender

// Hunt: CODE server / PHP-FPM spawning shells or download tooling (CVE-2026-110447 exploitation behavior)
let suspiciousChildren = dynamic(["sh", "bash", "dash", "curl", "wget", "base64", "nc", "ncat", "python", "python3", "perl", "chmod", "crontab"]);
Syslog
| where TimeGenerated > ago(14d)
| where ProcessName in~ ("coolwsd", "php-fpm", "php-fpm8.1", "php-fpm8.2", "php-fpm8.3", "apache2", "httpd", "nginx")
   or SyslogMessage has_any ("coolwsd", "php-fpm")
| extend ChildProc = extract(@"(?:CMD=|command=|exe=)[\"']?[^\s\"']*/(\w[\w.\-]*)", 1, SyslogMessage)
| where SyslogMessage has_any (suspiciousChildren)
| project TimeGenerated, Computer, ProcessName, SyslogMessage, ChildProc
| summarize Executions = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Computer, ProcessName, ChildProc
| order by LastSeen desc;
// Hunt: HTTP requests hitting the richdocumentscode proxy paths — identify pre/post-exploit traffic
Syslog
| where TimeGenerated > ago(14d)
| where SyslogMessage has_any ("/apps/richdocumentscode/", "/index.php/apps/richdocuments/")
| extend SourceIP = extract(@"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})", 1, SyslogMessage)
| summarize Requests = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Computer, SourceIP
| where Requests > 50 or LastSeen > ago(24h)
| order by Requests desc;

Velociraptor VQL

Deploy this as a hunt across your Nextcloud fleet to triage for active compromise: suspicious child processes of the CODE server, recently modified PHP files in app/data paths, and unexpected outbound connections from web processes.

VQL — Velociraptor

-- Triage Nextcloud hosts for richdocumentscode exploitation artifacts (CVE-2026-110447)
-- 1) Shells or tooling spawned by CODE/PHP/web processes
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE (
  CommandLine =~ 'coolwsd|php-fpm|apache2|httpd|nginx'
  OR Name =~ 'coolwsd|php-fpm'
)
AND (
  CommandLine =~ '/(sh|bash|dash)\b'
  OR CommandLine =~ 'curl |wget |base64 -d|crontab|nc |ncat |python'
)
-- 2) Recently modified PHP files in Nextcloud paths (potential web shells)
LET webshells = SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['/var/www/**/nextcloud/apps/**/*.php', '/var/www/**/nextcloud/data/**/*.php', '/srv/nextcloud/**/*.php'])
WHERE Mtime > now() - 1209600
ORDER BY Mtime DESC
SELECT * FROM webshells
-- 3) Outbound connections from web/CODE processes (C2 or payload retrieval)
SELECT Pid, Name, Status, Laddr, Raddr
FROM netstat()
WHERE Name =~ 'coolwsd|php-fpm|apache2|httpd|nginx|sh|bash'
  AND Status = 'ESTABLISHED'
  AND NOT Raddr.IP =~ '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)'

Remediation & Verification Script (Bash)

Run on each Nextcloud host. It reports the installed richdocumentscode version, updates all apps via occ, and sweeps for the persistence artifacts described above. Review output before declaring the host clean.

Bash / Shell

#!/bin/bash
# CVE-2026-110447 triage & remediation — Nextcloud richdocumentscode
# Adjust NEXTCLOUD_DIR and WEB_USER for your deployment.
NEXTCLOUD_DIR="/var/www/nextcloud"
WEB_USER="www-data"
OCC="sudo -u ${WEB_USER} php ${NEXTCLOUD_DIR}/occ"

echo "=== [1] Current richdocumentscode version ==="
$OCC app:list | grep -i -E 'richdocuments|code' || echo "richdocumentscode not installed"

echo "=== [2] Update richdocumentscode and all apps to latest (patched) releases ==="
$OCC app:update --all
# If the app is not business-critical and you cannot confirm a patched build:
# $OCC app:disable richdocumentscode

echo "=== [3] Sweep for recently modified PHP files (last 14 days) in web paths ==="
find ${NEXTCLOUD_DIR}/apps ${NEXTCLOUD_DIR}/data -name '*.php' -mtime -14 -type f 2>/dev/null | head -50

echo "=== [4] Check cron persistence for web account and root ==="
crontab -u ${WEB_USER} -l 2>/dev/null && echo "!! www-data has a crontab — investigate"
ls -la /etc/cron.d/ 2>/dev/null
grep -rEi 'curl|wget|base64|/tmp/|/dev/shm' /etc/cron.d/ /etc/crontab /var/spool/cron/ 2>/dev/null

echo "=== [5] Check SSH authorized_keys for unexpected entries ==="
for home in /root /home/* /var/www; do
  [ -f "${home}/.ssh/authorized_keys" ] && { echo "-- ${home}/.ssh/authorized_keys:"; cat "${home}/.ssh/authorized_keys"; }
done

echo "=== [6] Suspicious processes spawned by CODE/PHP/web processes ==="
ps -eo pid,ppid,user,comm,args --forest | grep -E 'coolwsd|php-fpm' -A2 | grep -E 'sh|bash|curl|wget|nc |python' || echo "none found"

echo "=== [7] Outbound connections from web/CODE processes ==="
ss -tupn 2>/dev/null | grep -E 'coolwsd|php-fpm|apache2|httpd|nginx' | grep ESTAB || echo "none found"

echo "=== [8] Review access logs for richdocumentscode endpoint hits ==="
grep -E 'richdocuments(code)?' /var/log/apache2/access.log* /var/log/nginx/access.log* 2>/dev/null | tail -30

echo "=== Done. Any hits in sections 3-7 warrant full IR scoping, not just cleanup. ==="

Remediation

Update immediately. Update the Collabora Online – Built-in CODE Server app to the latest fixed release via the Nextcloud app store or occ app:update --all, and apply any pending Nextcloud server updates at the same time. Verify the running version matches the fixed build listed in the Collabora/Nextcloud security advisory for CVE-2026-110447 — do not assume the update applied; confirm it.
If you cannot patch now, disable the app. occ app:disable richdocumentscode removes the attack surface entirely. Document editing via Collabora stops, but a critical unauthenticated RCE on a file server is not a risk you carry for convenience.
Hunt before you trust. Because exploitation is confirmed and backdoors are the objective, patching is only half the job. Run the detections above, review web access logs for requests to the richdocumentscode endpoints, and inspect for web shells, cron persistence, and rogue SSH keys. Any positive finding escalates to full incident response: preserve logs, isolate the host, rotate all credentials the host could reach (Nextcloud config contains database credentials; check for cloud storage tokens, SMTP creds, and LDAP bind accounts).
Reduce exposure going forward. If internet-facing document editing is required, prefer a dedicated, properly segmented Collabora Online server over the built-in CODE package, and place Nextcloud behind a reverse proxy with strict allowlisting of app endpoints. Restrict outbound egress from the web tier — the payload-retrieval and C2 stages of this campaign depend on it.
Watch for KEV listing. Given confirmed active exploitation of a critical flaw in widely deployed software, monitor the CISA Known Exploited Vulnerabilities catalog; a listing would impose remediation deadlines on federal agencies and should serve as your prioritization trigger regardless of sector.
Rebuild if compromise is confirmed. Web shells on a file-synchronization server mean the integrity of everything on that host is in question. For confirmed intrusions, rebuild from known-good media, restore data from pre-compromise backups, and rotate every secret the server touched. Cleaning a backdoored host in place is how attackers come back.

The defensive lesson here is one we've seen repeat across the self-hosted collaboration space: convenience-bundled components — a CODE server inside an app inside a PHP application — inherit none of the hardening scrutiny of a standalone deployment but all of the exposure. Inventory what's actually installed on your Nextcloud instances, not just what you remember installing.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub

CVE-2026-110447: Critical Collabora Online RCE in Nextcloud Under Active Exploitation — Detection and Remediation Guide