Cybersecurity professionals and privacy-conscious users are urged to take immediate action as a critical remote code execution (RCE) vulnerability in **Nextcloud's Collabora Online - Built-in CODE Server** app (**richdocumentscode**) is under active exploitation. ### The Vulnerability: CVE-2026-110447 The flaw, now identified as **CVE-2026-110447**, affects **richdocumentscode** versions prior to 26.4.303. It specifically targets the app's mechanism for initiating the bundled **Collabora** server. Exploitation occurs by sending a malicious request to the app’s `proxy.php` endpoint, leading to an operating system command injection. A key prerequisite for successful exploitation is that the built-in CODE server must be in a stopped state (e.g., following a restart, upgrade, or crash). Crucially, no authentication or user interaction is required, making this a high-severity threat. It's important to note that this vulnerability exclusively impacts the optional built-in CODE server app. Standalone **Collabora Online** servers, **Docker** and **RPM/DEB** installations, and **Nextcloud All-in-One** deployments are not affected, according to **Collabora**. ### Early Warning Signs and Active Exploitation Administrator reports indicate that attacks began as early as September 10, significantly predating the formal security bulletin, **GitHub** advisory, and CVE publication on October 14. This month-long gap provided attackers ample opportunity to compromise systems undetected. Impacted system administrators have reported the planting of PHP webshells, which attackers then used to search for sensitive data, including password databases, password manager artifacts, and cryptocurrency wallets. While some reports suggest ransomware operators are also exploiting the flaw, this could not be independently confirmed. ### The Challenge of Delayed Disclosure The delay in CVE assignment played a critical role in hindering timely defenses. A community warning was published on October 3, urging immediate updates, but the absence of a CVE ID made it difficult for administrators to accurately identify the issue and prioritize remediation efforts. Research from cybersecurity firm **Second Security** highlights this growing gap between security fixes and formal vulnerability notifications. Their study, which analyzed open-source flaws, found that the median interval between public fixes and CVE publication was 39 days in August, a significant increase from 5.1 days in January.  *Source: Second Security* **Second Security** suggests that the increasing volume of AI-assisted vulnerability discoveries is straining CVE processing and contributing to these delays. Alarmingly, public exploit code often emerges within hours of a security fix, well before a corresponding CVE is published. AI tools further simplify the generation of working exploits from published fixes.  **Examples of public exploits and CVE appearance times** *Source: Second Security* In the case of **Collabora**, the fix was committed on September 9, and version 26.4.303 was released on September 11. The advisory and CVE, however, were not published until October 14, creating a four-week window of vulnerability. **Nextcloud** has stated that **Collabora** reported the vulnerability in mid-September and an update became available via the app store. The company justified the disclosure delay by citing the need to give users time to update and the absence of widespread exploitation. **Collabora**, in a blog post, attributed the delayed announcement primarily to **GitHub** CVE-processing backlogs, which are reportedly under strain from increasing AI-driven security reports. ### Recommendations for System Administrators System administrators are strongly advised to upgrade to version 26.4.303 or later immediately. If the built-in CODE server app is not essential, it should be removed. Disabling the app is insufficient to mitigate the risk. This incident underscores the critical need for vigilance and rapid response in the face of evolving threat landscapes, particularly with the increasing delays in formal vulnerability disclosures.