CVE-2026-110447 exploited in wild to backdoor Nextcloud via Collabora RCE

Threat actors are actively exploiting a critical remote code execution vulnerability (CVE-2026-110447) in the Collabora Online Built-in CODE Server app for Nextcloud, enabling backdoor deployment on affected servers. The flaw is being used in the wild, though the full scope and victim profile remain unclear. This matters because Nextcloud is widely deployed for enterprise file sharing, and successful exploitation grants full server control, risking data exfiltration and lateral movement.