Search — “CVE-2026-110447”

CISA added Arista VeloCloud Orchestrator on-prem CVE-2026-114625, a SQL injection allowing a remote attacker to reach privileged internal functionality, to the KEV catalog on 2026-10-23 with a 2026-10-26 due date. CISA also added Collabora Online built-in CODE Server CVE-2026-110447, an OS command injection used with Nextcloud that allows remote code execution when the CODE server is not running, on the same date. The sources provided do not describe observed attack behavior, payloads, or indicators for either flaw, so hunt guidance is limited to patching and exposure review.

Attackers exploited a command-injection flaw (CVE-2026-110447) in proxy.php of Nextcloud's richdocumentscode (Collabora Online Built-in CODE Server) app before 26.4.303. Unauthenticated GET requests to /apps/richdocumentscode/proxy.php?status with $(...), ${IFS} and base64 -d|sh in the path wrote shx*.php web shells, beaconed uname -a to webhook.site, and the shells were then used to search for password vaults and crypto wallets. Hunt access logs for proxy.php?status with %2e%2e, $( or ${IFS}, shx*.php files in the app folder, ?c= requests to them, and sudo attempts by the web server account.

Threat actors are exploiting CVE-2026-110447, an OS command injection flaw in the built-in CODE server app (richdocumentscode) for Nextcloud, via a malicious request to the app's proxy.php endpoint. The flaw is reachable only when the built-in CODE server is stopped (e.g., after restart, upgrade, or crash), and requires no authentication. Affected admins reported attacks dating to September 10, with attackers planting PHP webshells and searching for password databases, password manager artifacts, and cryptocurrency wallets. Hunters should look for web requests to proxy.php and PHP webshells on Nextcloud hosts.