The Cybersecurity and Infrastructure Security Agency (CISA) Friday gave federal civilian agencies until Monday to fix a critical flaw in a Nextcloud document add-on that administrators say attackers have used since early September to plant backdoors. CISA's alert adds the bug, CVE-2026-110447, to its Known Exploited Vulnerabilities catalog. For any organization that runs its own file-sharing servers, the case shows that a fix can arrive weeks before the public warning, and that patching does not undo an intrusion.
What Happened
The flaw sits in Collabora Online's "Built-in CODE Server," an optional app that lets Nextcloud, self-hosted file-sharing and collaboration software, open and edit office documents in a browser without a separate document server. According to Collabora's GitHub advisory, a crafted request to the app's proxy.php file can run operating-system commands as the web server's user account with no login, an attack known as command injection. It works only while the built-in document server is not running, such as after a restart, an upgrade or a crash.
Collabora rates the flaw 9.2 out of 10, or critical. Versions below 26.4.303 are affected. Disabling the app is not enough; users must upgrade or remove it. Standalone Collabora Online servers are not affected, and BleepingComputer, citing Collabora, said Docker, Linux package and Nextcloud All-in-One installations are also safe.
The timeline is the striking part. BleepingComputer reported that Collabora committed the fix Sept. 9 and shipped version 26.4.303 on Sept. 11, while administrators reported attacks dating to Sept. 10, before the fixed version was available. The advisory and CVE identifier were not published until Oct. 14. A Nextcloud community forum post on Oct. 3 had already warned that the flaw was being exploited and that some users had found web shells, small scripts that give intruders remote control of a server.
According to BleepingComputer, attackers used those shells to search for password databases, password-manager files and cryptocurrency wallets. Some users reported ransomware operators exploiting the flaw, which BleepingComputer could not confirm. Nextcloud said it had not seen widespread exploitation, according to BleepingComputer, and no victim count has been published.
In a blog post cited by BleepingComputer, Collabora blamed the late announcement mainly on GitHub's backlog in processing CVE requests, which it said is strained by a rising volume of AI-driven security reports.
CISA's catalog entry sets an Oct. 26 due date, marks forensic triage as required under Binding Operational Directive 26-04 and lists known ransomware use as unknown. The directive, "Prioritizing Security Updates Based on Risk," tells agencies to rapidly fix high-risk listed flaws on internet-exposed systems and sets expectations for checking whether a system was compromised before it was patched.
The same day, CISA added CVE-2026-114625, a database-injection flaw in the on-premises version of Arista's VeloCloud Orchestrator, the console that manages VeloCloud branch-office networks, with the same deadline and triage requirement. The Primary Wire reported Thursday that it is the third exploited zero-day in the product in four months, citing SecurityWeek. Arista's advisory names no attacker and gives no count of affected customers.
Why It Matters
Self-hosted collaboration servers often hold sensitive documents and stored credentials, and an updated server can still carry a shell planted before the update. CISA's forensic triage requirement addresses that risk for federal agencies; boards can ask whether their own teams check for prior compromise or stop at patching.
The disclosure gap is a policy issue as well as an operational one. Security teams that track risk through CVE feeds had nothing to act on for about five weeks while attacks were under way. If Collabora's account is right, the flood of AI-generated reports is slowing the system that is supposed to warn defenders.
What to Watch
- Whether agencies meet the Oct. 26 deadline for both flaws.
- Whether the unconfirmed ransomware reports are substantiated.
- Any victim counts or attribution for the Collabora or Arista attacks.
- Whether other disclosure channels report backlogs tied to AI-driven submissions.
