A critical flaw in an optional Nextcloud add-on is being used by attackers to run commands on business file servers, and the US cyber agency CISA added it to its list of actively exploited vulnerabilities on 23 October.

• What it is: an unauthenticated command injection (CVE-2026-110447) in the built-in Collabora Online CODE Server app for Nextcloud, rated 9.2 out of 10 for severity.
• Who is affected: businesses running their own Nextcloud with the built-in CODE Server app older than version 26.4.303, including Nextcloud 29 and earlier. Setups using a separate Collabora server or Nextcloud All-in-One are not affected.
• The risk: an attacker needs no password and can take over the server, with web shells reported since 10 September and stolen configuration files containing credentials.
• What to do: update the app to 26.4.303 or later, or remove it. Simply switching it off is not enough. Older Nextcloud 29 systems need upgrading to version 30 or newer.
• Check for damage: run the Nextcloud integrity check, look for unexpected PHP files in the app folder, and change database, mail and app passwords if anything looks wrong.

If your business hosts Nextcloud, we recommend confirming your version today. Contact OzComm Network Solutions if you would like us to check it for you. Source: Rescana analysis.