Critical Nextcloud Collabora flaw CVE-2026-110447 allows unauthenticated code execution

A security flaw tracked as CVE-2026-110447 has been reported in the CODE server component bundled with the Nextcloud Collabora integration, rated 9.2 in severity. It can be exploited without authentication to achieve remote code execution, and reports indicate attackers have used it to install web shells. Because the vulnerable code runs in a separate document server, simply disabling the Nextcloud app does not remove the risk. The fix is reported in CODE Server build 26.4.303, and administrators are advised to verify the running version and locate every deployed instance. Experts also recommend checking for web shell indicators and unusual outbound connections before rebuilding affected systems.