Executive Summary
In September 2026, attackers exploited a critical command injection vulnerability (CVE-2026-110447) in Nextcloud's Collabora Online Built-in CODE Server app to deploy web shells on vulnerable servers. The flaw allowed unauthenticated attackers to execute arbitrary commands when the local document server was offline during restarts, upgrades, or crashes. Multiple administrators reported compromised servers starting September 10, with attackers deploying PHP web shells and searching for cryptocurrency wallets, credential stores, and sensitive files. Collabora patched the vulnerability in version 26.4.303 on September 11, but the security advisory wasn't published until October 14, leaving many installations exposed for weeks.
This incident highlights the growing trend of supply chain attacks targeting third-party integrations and the critical importance of timely security disclosures, especially as organizations increasingly rely on interconnected cloud applications and document collaboration platforms.
Why This Matters Now
Web application vulnerabilities in popular collaboration tools are increasingly targeted by attackers seeking initial access to corporate environments, making immediate patching and security monitoring of third-party integrations critical for preventing data breaches and lateral movement.
Attack Path Analysis
Attackers exploited CVE-2026-110447, a command injection vulnerability in Nextcloud's Collabora CODE app, to deploy PHP web shells during server downtime. They used the shells to search for credential stores and cryptocurrency wallets, establishing persistence on compromised servers. The attack targeted specific file types including password managers, Bitcoin wallets, and other sensitive data stores. Command and control was maintained through deployed web shells accepting HTTP requests. Data exfiltration was attempted through webhook callbacks, though full scope remains unclear. The impact included potential exposure of all files accessible to the web server account.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers exploited CVE-2026-110447 command injection vulnerability in proxy.php script of Collabora's richdocumentscode app, sending malicious requests during server downtime to execute shell commands
Related CVEs
CVE-2026-110447
CVSS 9.2A command injection vulnerability in Collabora Online - Built-in CODE Server allows unauthenticated remote attackers to execute arbitrary commands when the local document server is not running.
Affected Products:
Collabora Collabora Online - Built-in CODE Server – < 26.4.303
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Valid Accounts
Web Shell
Unix Shell
File and Directory Discovery
Credentials In Files
Data from Local System
Exfiltration Over C2 Channel
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Software security testing
Control ID: 6.2.4
NYDFS 23 NYCRR 500 – Risk Assessment
Control ID: 500.09
DORA – ICT third-party risk management
Control ID: Article 8
CISA ZTMM 2.0 – Asset Management
Control ID: ZT.AM-3
NIS2 Directive – Incident handling and business continuity
Control ID: Article 21.2.b
ISO 27001 – Management of technical vulnerabilities
Control ID: A.12.6.1
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
Nextcloud collaboration platforms face critical web application vulnerabilities enabling unauthenticated command execution, requiring immediate patching and enhanced zero trust segmentation controls.
Health Care / Life Sciences
Healthcare organizations using Nextcloud for document collaboration risk HIPAA violations through web shell attacks exposing patient data and requiring encrypted traffic solutions.
Higher Education/Acadamia
Educational institutions deploying Nextcloud servers vulnerable to command injection attacks compromising research data and requiring kubernetes security and egress policy enforcement.
Financial Services
Financial sector Nextcloud deployments face cryptocurrency wallet theft risks through web application exploitation, demanding inline IPS protection and anomaly detection capabilities.
Sources
- Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE Apphttps://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.htmlVerified
- Collabora Online Security Advisory GHSA-g3vx-3m76-fghhhttps://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghhVerified
- CVE-2026-110447 Recordhttps://www.cve.org/CVERecord?id=CVE-2026-110447Verified
- Collabora Online Built-in CODE Server GitHub Issue #354https://github.com/CollaboraOnline/richdocumentscode/issues/354Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would likely reduce the blast radius of this Nextcloud attack by constraining lateral movement and limiting outbound exfiltration paths after the initial web shell deployment.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Cloud native security fabric may limit the scope of command execution by constraining the compromised workload's access to other cloud resources and services through workload-aware policies
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely constrain the web shell's lateral reach by limiting network paths available to the compromised web server process across different application tiers
Control: East-West Traffic Security
Mitigation: East-west traffic controls may restrict the attacker's ability to access other Nextcloud instances or internal services by blocking unauthorized inter-workload communication patterns
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility may detect and alert on anomalous outbound HTTP communication patterns from the compromised workload to external webhook services and command infrastructure
Control: Egress Security & Policy Enforcement
Mitigation: Egress controls would likely constrain data exfiltration by blocking or limiting outbound connections to unauthorized external destinations and webhook callback services from the compromised workload
Despite CNSF constraints, files directly accessible to the compromised web server account may still face exposure, though the scope would likely be reduced to the segmented workload boundaries
Impact at a Glance
Affected Business Functions
- Document Collaboration Services
- File Sharing and Storage
- Office Productivity Applications
- Remote Work Infrastructure
Estimated downtime: 3 days
Estimated loss: N/A
Potential exposure of files accessible to web server account including credential stores, cryptocurrency wallets, and document repositories. Attackers searched for sensitive files including *.kdbx password databases, wallet.dat files, and authentication tokens from services like Bitwarden and 1Password.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation with least privilege access controls to limit web application account permissions and prevent lateral file system traversal
- • Deploy Cloud Firewall (ACF) with egress filtering to block unauthorized outbound connections to webhook services and unknown destinations
- • Enable Inline IPS (Suricata) to detect and block command injection attempts and malicious payload patterns in web application traffic
- • Establish Multicloud Visibility & Control to monitor anomalous file access patterns and repeated malformed requests targeting vulnerable applications
- • Implement Egress Security & Policy Enforcement with FQDN filtering to prevent data exfiltration through unauthorized external services and webhooks
