Critical Nextcloud Vulnerability (CVE-2026-110447) Actively Exploited to Plant Web Shells

A critical, unauthenticated vulnerability in the Collabora Online integration for Nextcloud, tracked as CVE-2026-110447 with a CVSS score of 9.2, is being actively exploited. Attackers are using this flaw to plant web shells on self-hosted Nextcloud servers, allowing them to execute operating-system commands without authentication. This poses a significant risk to organizations using the open-source platform for sensitive file management.