Quick answers
- Is CVE-2026-77167 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-77167 being exploited in the wild.
- How severe is CVE-2026-77167?
- High severity, with a CVSS score of 7.5, published 27 October 2026.
- Which products and versions are affected?
- Nextcloud Nextcloud Server.
- Is there a fix for CVE-2026-77167?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-77167 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-77167?
- Check whether you run Nextcloud Server. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An unauthenticated attacker can abuse the federated share endpoint to write arbitrary rows into the oc_share_external database table. The injected rows persist indefinitely because the application lacks an automatic cleanup mechanism, allowing the attacker to trigger three distinct denial-of-service conditions that self-renew on a 24-hour cycle as long as the malicious entries remain in the database.
Affected products
- Nextcloud Nextcloud Server
Timeline
- 2026-10-27: disclosed