# Collabora warns disabling vulnerable Nextcloud app does not stop attacks

_Published Wednesday, October 14, 2026 at 4:12 PM EDT · Security, Infrastructure · Latest · Tier 2 — Notable_

![Collabora warns disabling vulnerable Nextcloud app does not stop attacks — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkZLcjmZtzt6NpWa8x4Wz7EdcOQEW6xYv6DA_mBnwy1ctZZeRAyeSYLES-H_mkr1QOBv72WNuGKwKQ-NN179Rw8BRTcYO38sYwxcbDkg1ISW_qWrCRJ9JfUXh3102OmwrF0HQq6dbSc58VXACXoi_EoI8ysPuSlzB_nBcHuFl9r3QakOsGG9GUm6UVOU8/s1700-nu-rw-lo-l85-e365/nextcloud.jpg)

Collabora published an advisory Wednesday warning that an exploited flaw in its optional Nextcloud Built-in CODE Server app requires an update or removal; disabling the app does not close the vulnerability. Versions before 26.4.303 allow unauthenticated commands when the app's local document server is down, including during restarts or crashes.

Administrators reported attackers planting files that execute commands through web requests. The fix shipped September 11, but requires Nextcloud 30 or later. Users on Nextcloud 29 or older must upgrade Nextcloud or remove the app. Standalone Collabora Online servers are unaffected.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html)

---
Canonical: https://techandbusiness.org/newswire/Qpu5x74T7y9aOoL-hwtAjx
Published: 2026-10-14T20:12:19.828Z
Story chronology: 2026-10-14T17:38:31.000Z
Retrieved: 2026-10-14T22:34:00.933Z
Publisher: Tech & Business (techandbusiness.org)