# CISA Adds Nextcloud Flaw to KEV

CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities (KEV) catalog on October 23, 2026, setting an October 26 federal remediation deadline. The critical flaw affects Nextcloud deployments running the optional Built-in CODE Server app below version 26.4.303; standalone Collabora deployments and several other deployment types are reported unaffected. Federal agencies must address affected systems by the deadline, while contractors supporting those environments should verify exposure and coordinate remediation with their agency customers.

- Federal agencies have **until October 26, 2026** to remediate affected deployments by updating the app or removing it.
- Contractors should identify whether systems they operate or support use the vulnerable Built-in CODE Server version, then assist with remediation and investigation for possible compromise.
- Procurement and IT teams can use the affected deployment and version details to target vulnerability assessments rather than treating all Nextcloud or Collabora installations as exposed.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity
**Published:** October 25, 2026

### Government Entities
- Cybersecurity and Infrastructure Security Agency (CISA)

### Vendors
- Nextcloud ()
- Collabora ()

### Sources
- [Nextcloud Collabora Flaw CVE-2026-110447 Hits CISA KEV](https://shattered.io/nextcloud-collabora-cve-2026-110447-cisa-kev-cvss-9-2-2026) - shattered.io