Attackers exploit Collabora built-in CODE Server flaw in Nextcloud to run commands

What happened

Attackers have been taking over Nextcloud servers through a flaw in the Collabora Online Built-in CODE Server app, also known as richdocumentscode. The bug sits in the app's proxy.php file. When the bundled CODE server is not running, for instance shortly after a restart, an attacker can slip operating system commands into a request and have the server execute them. No login is required.

The flaw was exploited in September and October 2026. It was published on 14 October 2026, and CISA added it to its Known Exploited Vulnerabilities catalog on 23 October 2026. Nextcloud has posted a notice urging users of the built-in server to update as soon as possible.

Who is affected

Nextcloud installations that use Collabora's Built-in CODE Server app (richdocumentscode) in versions before 26.4.303 are affected. Standalone Collabora Online servers are not vulnerable. Only setups that rely on the built-in CODE server inside Nextcloud carry the flaw.

How serious is it

The flaw carries a CVSS 4.0 score of 9.2, rated critical. An attacker on the network needs no account and no user interaction, and a successful attack gives full control over confidentiality, integrity and availability on the affected server. One condition applies: the CODE server must not be running at the time, which can happen after a restart.

Attackers are already using it, and CISA lists it in its Known Exploited Vulnerabilities catalog. US federal agencies were given until 26 October 2026 to act.

What you should do

1. 1Update the Collabora Online Built-in CODE Server app in Nextcloud to version 26.4.303 or later.
2. 2Follow the vendor and Nextcloud instructions for mitigations, and stop using the app if you cannot apply them.
3. 3Check servers that ran a vulnerable version for signs of compromise, since the flaw was exploited before the fix was widely known.

Quick facts