CISA Flags Exploited Collabora Built-in CODE Flaw; Fix Starts at 26.4.303
CVE-2026-110447 affects the Nextcloud built-in CODE app before 26.4.303. Standalone Collabora servers are unaffected, and disabling the app is insufficient.
CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog on October 23, citing active exploitation. Collabora’s advisory identifies the affected component as the Collabora Online Built-in CODE Server app for Nextcloud, package richdocumentscode, in versions before 26.4.303. OrangeX.com Security.
Scope and remediation
The flaw can run operating-system commands as the web-server user without authentication while the built-in CODE server is not running, including after a restart, upgrade or crash. Collabora says disabling the app is insufficient: upgrade to 26.4.303 or later, or remove it. Standalone Collabora Online servers are not affected. Users on Nextcloud 29 or earlier need to upgrade Nextcloud or remove this app. OrangeX.com News.
OrangeX.com Analysis
For teams storing operational documents on exposed collaboration servers, first identify the actual deployment and component version. Patching closes the documented flaw but does not prove that no earlier intrusion occurred. Review for signs of compromise alongside remediation. These advisories do not establish a breach at any cryptocurrency platform or a quantified asset loss. OrangeX.com Trust Center.
Related Reports
Node.js Security Updates Fix Brotli Flaw Across Three Release Lines
Node.js lists 26.12.1, 24.22.1 and 22.23.4 as security releases. Exposure to the high-severity Brotli flaw depends on an application’s handling of compressed input.
Electrum 4.8.3 Fixes Malicious-Server Fee-Bump Attack; Users Urged to Upgrade
An October 24 advisory covers versions before 4.8.3. Loss requires signing the altered transaction; check full destination addresses and amounts.
CISA and FBI Warn of SafePay Ransomware, Citing at Least 600 Victims Since 2024
The October 20 joint warning highlights exposed credentials, internet-facing systems and backup disruption; its victim count is not specific to crypto businesses.
