Organisations using Nextcloud with the Collabora Online built-in CODE Server app should review their exposure after reports that attackers are actively exploiting a critical remote code execution flaw, tracked as CVE-2026-110447. The issue affects the richdocumentscode app and could allow threat actors to run commands on vulnerable servers and establish persistent access.

What happened

According to reporting on the incident, threat actors are exploiting a critical vulnerability in Collabora Online - Built-in CODE Server for Nextcloud. The flaw is described as a remote code execution issue, which means an attacker may be able to execute commands on the targeted server if the vulnerable component is exposed and unpatched.

The affected component is the richdocumentscode app used to enable document editing through Collabora within Nextcloud environments. Reports indicate the vulnerability has been used to backdoor Nextcloud servers, suggesting attackers are not only attempting initial access but also trying to maintain persistence after compromise.

Why it matters for European businesses

Nextcloud and Collabora are widely used in Europe by businesses, public-sector organisations and privacy-conscious teams that prefer self-hosted collaboration tools over large US-based cloud platforms. That makes this issue especially relevant for European SMEs, regulated organisations and IT teams managing internal file-sharing and document collaboration platforms.

A successful compromise could affect more than document editing. If attackers gain command execution on the server, they may be able to access stored files, move laterally into other systems, steal credentials, deploy malware or disrupt operations. For businesses using Nextcloud as part of daily document workflows, the security risk can quickly become an operational problem.

This incident is also a reminder that self-hosted and privacy-focused platforms still require disciplined patching, monitoring and hardening. Choosing European or open-source infrastructure can support data control goals, but it does not reduce the need for active security maintenance.

Who may be affected

• Businesses running self-hosted Nextcloud with the Collabora Online built-in CODE Server app enabled.
• SMEs and mid-sized organisations using Nextcloud for internal file sharing, collaboration and document editing.
• IT teams and managed service providers responsible for patching and securing private cloud environments.
• Regulated organisations where compromised collaboration servers could create data protection, confidentiality or incident-reporting consequences.

Cloud-hosted users should verify with their provider whether the vulnerable component is in use and whether remediation has already been applied. Self-hosted deployments are likely to require direct action by internal IT teams or external administrators.

What companies should consider

• Identify exposure immediately: confirm whether your Nextcloud environment uses the richdocumentscode app or any Collabora Online built-in CODE Server deployment.
• Apply vendor fixes or mitigations: follow Nextcloud and Collabora security guidance and update affected systems as soon as patches are available for your deployment.
• Check for signs of compromise: review server logs, admin activity, newly created scheduled tasks, unknown files, unusual outbound connections and unauthorised changes that could indicate persistence.
• Restrict access where possible: limit public exposure of admin interfaces and related services, and review network segmentation around collaboration servers.
• Rotate credentials if compromise is suspected: this may include admin accounts, service credentials and linked authentication tokens.
• Review backup readiness: ensure clean backups are available in case recovery is needed after a confirmed intrusion.
• Prepare incident response steps: if sensitive business or personal data may have been accessed, assess whether internal reporting, customer communication or regulatory review is necessary.

For European businesses, the practical message is straightforward: if you run self-hosted collaboration infrastructure, treat actively exploited vulnerabilities as a priority operational risk. Even tools chosen for privacy, sovereignty or cost control need rapid patching and security oversight when exploitation begins.