No official fix confirmed yet
Until a fix ships, follow the vendor's mitigations, limit exposure of affected systems, and watch this record for a patch.
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.
Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.
Developments from the last 30 days, newest first.
Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers
Source reporting says attackers are already exploiting this, so exposed affected systems are at immediate risk.
Basis: Reporting by BleepingComputer
Source reporting says attackers are already exploiting this, so exposed affected systems are at immediate risk.
Treat this as an emergency.
