Web-Shell

vulnerabilities 2026-10-18 Critical
Nextcloud Built-in CODE Server CVE-2026-110447: Unauthenticated Command Injection Exploited for Webshells Since September
A critical OS command injection in the Collabora-based built-in CODE server app for Nextcloud (richdocumentscode) has been exploited in the wild since about September 10; the CVE was published October 14, over a month after the patch.
active-exploitation command-injection rce web-shell cloud authentication-bypass

Nextcloud Built-in CODE Server CVE-2026-110447: Unauthenticated Command Injection Exploited for Webshells Since September