The Fix Existed. Nobody Knew to Install It.
A security patch for a critical remote code execution vulnerability in Collabora Online shipped on September 9, 2026. A new version containing that fix went live in the app store on September 11. Attackers were already exploiting the flaw by September 10.
The CVE — CVE-2026-110447 — wasn't published until October 14. Thirty-seven days passed between the fix and the formal advisory. Thirty-seven days where a sysadmin scanning NVD for new threats would have found nothing. Thirty-seven days where the vulnerability was effectively invisible to any tool keyed on CVE identifiers.
That window is the story here. Not just because attackers used it, but because it's getting wider, and the forces widening it are the same AI-driven processes that are supposed to make security better.
What CVE-2026-110447 Actually Does
The flaw lives in the Collabora Online - Built-in CODE Server app for Nextcloud, known in the app store as richdocumentscode. This is an optional component that bundles a Collabora document server directly inside a Nextcloud instance, so users get collaborative editing without spinning up a separate server.
The vulnerability is an OS command injection in the mechanism that starts the bundled Collabora server. The attack vector is the proxy.php endpoint. A malicious HTTP request to that endpoint triggers command execution on the host. No authentication required. No user interaction needed.
There is one condition: the built-in CODE server must be stopped at the time of the request. This happens routinely after a restart, an upgrade, or a crash. The app is designed to be running, but real-world deployments go through cycles where the server process is down. Those windows are the attack surface.
Affected versions are everything before 26.4.303.
Collabora confirmed that standalone Collabora Online deployments, Docker installations, RPM/DEB packages, and Nextcloud All-in-One setups are not affected. If you're using any of those configurations, breathe easy. The problem is specifically the built-in CODE Server app shipped through the Nextcloud app store.
How the Attacks Played Out
BleepingComputer's reporting, drawn from multiple administrator accounts posted in community forums, tells a grim story. Starting around September 10, attackers sent crafted requests to the proxy.php endpoint on vulnerable instances. Successful exploitation planted PHP webshells on the host.
From those webshells, the operators moved laterally into credential harvesting. They searched the filesystem for password databases, password manager export files, and cryptocurrency wallet files. This isn't ransomware-style smash-and-grab. It's patient espionage with financial motivation — the kind of post-exploitation that precedes account takeover or targeted theft.
Some users reported ransomware operators were also exploiting the flaw, though BleepingComputer could not independently confirm that claim. Treat it as unverified for now.
What is verified: the community issued warnings on October 3, urging administrators to update immediately. By that point, attacks had been running for roughly three weeks. The lack of a CVE ID meant administrators couldn't correlate the threat with automated scanning tools or vulnerability management platforms. They saw weird activity. They saw webshells. They couldn't point to a tracking number and say "this is that one."
The 39-Day Median: AI Is Breaking Disclosure Timelines
Here's where this incident connects to something bigger. A study from cybersecurity firm Second Security, cited in the BleepingComputer report, analyzed the gap between public security fixes and CVE publication across open-source projects. Their finding: in August 2026, the median interval was 39 days. In January 2026, it was 5.1 days.
That's not noise. That's a structural shift happening within a single year.
The researchers attribute this to growing volumes of AI-assisted vulnerability discoveries straining CVE processing pipelines. More researchers (human and machine-assisted) are finding flaws faster than the numbering and publication infrastructure can keep up. The GitHub advisory system, which feeds into the CVE program, is a bottleneck.
The second finding is perhaps more alarming for defenders. In many of the cases they studied, public exploit code appeared online within hours of a security fix being committed — and days before the corresponding CVE was published. AI tools lower the skill floor for exploit development. A researcher can commit a patch to a public repository, and within hours someone (or something) analyzes the diff, writes a working exploit, and posts it.
This creates an inverted incentive structure. The responsible disclosure model assumed that publishing a CVE would coincide with or follow the emergence of exploits. When AI compresses exploit development to near-zero time, and the CVE pipeline is simultaneously stretched, defenders get information after attackers have had it for days or weeks.
In Collabora's case, the timeline maps almost perfectly onto the median the Second Security study describes. Fix on September 9, version released September 11, CVE published October 14. That's a 35-day gap from fix to CVE. Close to their 39-day median. The numbers line up because the same systemic pressure that produces that median also produced this specific window of silent exploitation.
What Collabora and Nextcloud Said
Collabora attributed the delayed announcement primarily to GitHub CVE-processing backlogs. They said those backlogs are under strain from increasing volumes of AI-driven security reports — the same force the Second Security study identifies.
Nextcloud told BleepingComputer that Collabora reported the vulnerability in mid-September and that an update became available through the app store at that time. When asked about the disclosure delay, Nextcloud said it was to give users time to update, and that they had not observed widespread exploitation.
Whether you find that explanation satisfactory depends on your threat model. "We didn't observe widespread exploitation" is technically accurate if your monitoring is limited to official channels, while affected users are posting in community forums that may not feed into that observation pipeline. The administrators who found webshells on their systems were clearly not seeing an absence of exploitation.
Immediate Actions for Nextcloud Administrators
If you run a Nextcloud instance with the Built-in CODE Server app (richdocumentscode):
Update immediately to version 26.4.303 or later. This is the fixed release. It contains the patch for the command injection in the server startup mechanism.
If you don't need the built-in CODE server, remove the app entirely. Collabora specifically warned that disabling the app is insufficient — the attack surface persists if the code is still present on the filesystem. Remove it. Don't just toggle it off.
Audit for compromise if you're on a vulnerable version. Look for unexpected PHP files in web-accessible directories, particularly anything named generically or using random strings. Check webserver access logs for unusual POST requests to proxy.php. If you find a webshell, assume the attacker explored further: your password databases, any exported credential files, and cryptocurrency wallets stored on that host are potentially compromised.
Review what was accessible from that host. If your Nextcloud instance sits on a machine that also stores SSH keys, API tokens, or database credentials, those are in scope for post-exploitation theft.
Why This Matters Beyond Nextcloud
The Collabora incident is a single data point, but it lands precisely where two dangerous trends intersect. First: AI-assisted exploit generation has compressed the time between fix and weaponization. Second: AI-assisted vulnerability discovery has compressed the time between discovery and fix — without compressing the time between fix and formal notification. The CVE pipeline hasn't scaled.
The practical consequence for defenders is that a new class of zero-day exists that isn't technically zero-day. The fix is public. The patch is available. But the vulnerability is functionally unknown to your scanning tools, your vulnerability management platform, and anyone triaging alerts by CVE identifier. These are "silent days" — the period where you're vulnerable and the ecosystem hasn't caught up to telling you so.
Organizations with asset inventories that include self-hosted open-source applications are particularly exposed. Collabora Online and Nextcloud are popular in exactly the environments where security staffing is thin: universities, small businesses, open-source-focused orgs, home labs run by privacy-conscious users who don't think of themselves as targets.
The median used to be 5.1 days. It's 39 now. If the trend continues, we're heading toward a world where the most dangerous vulnerabilities aren't the ones nobody has found — they're the ones everybody has already fixed but nobody knows about yet.
The Bottom Line
CVE-2026-110447 is patched. If you're running richdocumentscode below 26.4.303, update or remove it today. Check for compromise if you think you were exposed during that September-October window.
But the larger lesson here isn't about one CVE. It's about the widening gap between the speed at which defenders can fix things and the speed at which the notification system tells the world. AI is on both sides of that gap — accelerating discovery and accelerating exploitation — while the CVE pipeline creaks under the load.
The next time you see a patch release in an open-source project and there's no CVE attached, don't assume the silence means safety. It might mean something got fixed quietly, an exploit is circulating, and nobody with a tracking number has noticed yet.
