Critical Nextcloud Collabora app flaw exploited to plant web shells
Hackers are actively exploiting an unauthenticated remote code execution vulnerability in the Nextcloud Collabora Online integration to compromise self-hosted servers.
FTMQ Security, written by our newsroom0 views
Hackers are actively exploiting an unauthenticated vulnerability in the Collabora Online integration app for Nextcloud to plant web shells on self-hosted servers. Tech Insider reported that BleepingComputer and The Hacker News both documented the active attacks. The security flaw allows unauthorized attackers to gain access to vulnerable environments. [1]
The vulnerability is tracked as CVE-2026-110447 and carries a severity rating of 9.2. According to Tech Insider, the security issue allows attackers to execute operating system commands on target servers without requiring any login credentials. The targeted application is widely used by organizations to collaboratively edit documents directly within Nextcloud. [1]
The severity score for the flaw is based on the Common Vulnerability Scoring System. The framework calculates security ratings from zero to ten based on metrics that measure how easy an exploit is to execute and its overall impact on target systems. [1][2]
In short
- CVE-2026-110447 carries a CVSS score of 9.2.
- The flaw allows unauthenticated attackers to run operating system commands on Nextcloud servers.
- BleepingComputer and The Hacker News reported active exploitation to deploy web shells.
Sources
Every paragraph above points to the numbered items it rests on. Read the originals here.
- [1]Nextcloud Vulnerability CVE-2026-110447: CVSS 9.2 [2026]https://tech-insider.org/, 17h ago (the report this story comes from)
Background
- [2]Common Vulnerability Scoring System on Wikipedia
Our newsroom writes these reports with the help of software, from the 2 sources listed and nothing else, and checks them against those sources. Facts can still be wrong or move on; the originals are the record. Spotted a mistake? Write to daniel@monsterkong.com.
Related from FTMQ Security
Earlier reports of ours on the same people and subjects.
- Hackers exploit Collabora CODE flaw to deploy Nextcloud backdoorsTop Stories, 3d ago
- High severity NVIDIA DCGM Exporter vulnerability threatens internet exposed GPU serversCybercrime and Scams, 9d ago
- Atlassian patches critical arbitrary file access vulnerability CVE-2026-21589 across productsIncident Response, 7d ago
- Hitachi Energy warns of unauthenticated access flaw in Asset SuiteThreat Intelligence, 12d ago
More in Bugs and Patches
- CISA orders federal agencies to patch critical Windows Shell vulnerability2h ago
- Microsoft patches actively exploited Windows Shell zero day vulnerability3d ago
- Hackers chain Ivanti zero days to gain remote root access4d ago
- Citrix releases critical security patch for NetScaler ADC and Gateway9d ago
- Citrix issues emergency patch for critical NetScaler vulnerability9d ago
- Proof of concept exploit released for critical VMware VMXNET3 security flaw10d ago
Get the day in one email
Reports like this one, the top news of the last 24 hours, every morning. Free, one email a day; readers can comment under every report.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.
Comments
Loading
Join the conversation
Comments are open to readers of our daily email: the top news of the last 24 hours, every morning, free. Sign up and the comment box opens.
Already on the list? Enter the same address and we will send a sign-in link.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.