CISA Flags Exploited Collabora Built-in CODE Flaw; Fix Starts at 26.4.303
CVE-2026-110447 affects the Nextcloud built-in CODE app before 26.4.303. Standalone Collabora servers are unaffected, and disabling the app is insufficient.
CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog on October 23, citing active exploitation. Collabora’s advisory identifies the affected component as the Collabora Online Built-in CODE Server app for Nextcloud, package richdocumentscode, in versions before 26.4.303. OrangeX.com Security.
Scope and remediation
The flaw can run operating-system commands as the web-server user without authentication while the built-in CODE server is not running, including after a restart, upgrade or crash. Collabora says disabling the app is insufficient: upgrade to 26.4.303 or later, or remove it. Standalone Collabora Online servers are not affected. Users on Nextcloud 29 or earlier need to upgrade Nextcloud or remove this app. OrangeX.com News.
OrangeX.com Analysis
For teams storing operational documents on exposed collaboration servers, first identify the actual deployment and component version. Patching closes the documented flaw but does not prove that no earlier intrusion occurred. Review for signs of compromise alongside remediation. These advisories do not establish a breach at any cryptocurrency platform or a quantified asset loss. OrangeX.com Trust Center.
Related Reports
BTCPay Urges Fresh Servers for Affected Old Instances, Beyond a Version Update
BTCPay’s November 2 advisory links attacks to 2.4.1 and earlier. It recommends a fresh server and new wallet for affected old instances, even if subsequently updated.
HKMA and HKUST Launch Post-Quantum Planning Toolkit for Banks
The HKMA and HKUST launched a PQC Toolkit on November 2. It supports bank transition planning after an initial readiness score of 2.3/10; full readiness by 2030 is a target.
Chainalysis Discloses Customer Data Access as Security Investigation Continues
Chainalysis says customer identity records were accessed, with no evidence to date of access to investigation content, clear-text passwords or session tokens.
