Nextcloud Collabora Online Built-in CODE Server CVE-2026-110447 Update Guide
October 18, 2026
CVE-2026-110447 concerns the Collabora Online Built-in CODE Server delivered through the built-in Nextcloud CODE app when its version is earlier than 26.4.303. The update floor is 26.4.303 or later. This guidance is limited to that built-in app: a standalone Collabora deployment is outside this case’s scope, even when it works with Nextcloud. Government CSIRT reporting says exploitation has been observed; that does not mean a particular organization has been affected.
Check whether the built-in app is affected
First confirm that document editing uses the built-in Nextcloud CODE app rather than a standalone Collabora service. Then check the installed app version. An in-scope installation below 26.4.303 should be treated as a maintenance priority.
Do not apply this article’s version conclusion to standalone Collabora. Its support status, release guidance, and maintenance choices need to be evaluated separately.
- Built-in Nextcloud CODE app before 26.4.303: update is needed.
- Built-in Nextcloud CODE app at 26.4.303 or later: the stated repair floor is met.
- Standalone Collabora: outside the scope of this CVE guidance.
Update through the normal trusted process
Use the normal trusted Nextcloud update process for the built-in app, selecting a compatible supported release at 26.4.303 or later. Plan the change around normal business use of shared documents and confirm the reported installed version after the update.
The version floor is not a claim that it is the newest available version, nor independent proof that every environment’s configuration and integrations have been tested. Keep routine backups, maintenance safeguards, and support procedures appropriate to the site.
Confirm service and review relevant history
After updating, open and edit a nonsensitive test file using the normal document-editing workflow. Confirm that expected collaboration functions remain available and investigate unexpected service behavior through ordinary support channels.
Because observed exploitation has been reported publicly, review relevant available history for unusual activity in line with existing retention and incident practices. Findings require evidence-based follow-up; lack of an observed finding has limited meaning where history is incomplete.
