Vendors race to patch exploited flaws in Nextcloud, Next.js, Drupal, NGINX and PAN-OS

· Cybersecurity

A wave of critical vulnerabilities is being patched across widely deployed enterprise software. Attackers are exploiting a command execution flaw in the Collabora Online CODE Server app for Nextcloud to backdoor servers, tracked as CVE-2026-110447. Next.js shipped an out-of-band fix for two critical unauthenticated RCE flaws in React Server Components and librsvg plus a high-severity DoS. Drupal patched a critical Field UI issue in versions 11.4.10, 11.3.19 and 10.6.19. NGINX released 1.30.6 and 1.31.7 fixing five flaws, one dating to 2005. Palo Alto Networks patched an actively exploited PAN-OS RCE (CVE-2026-0322), and Cisco patched an exploited Secure Email Gateway flaw allowing root-level command execution. Previdian also reported exploitation of a Langflow RCE.

Why it matters：Enterprise patch cycles are under strain: several of these flaws are under active exploitation and touch core web, CMS, mail and firewall infrastructure.

Key points

  • Collabora flaw in Nextcloud is exploited to install backdoors.
  • NGINX fix addresses a bug present since 2005.
  • Palo Alto and Cisco flaws are under active exploitation.

Sources (original reporting)

More stories from this day