Thanks for flagging this — I checked my own instances against it today. For anyone wanting to verify quickly, I put together a free 30-second self-test that walks through the exact exposure checks (app version, proxy.php reachability, and the hunt checklist if you were exposed):
Nextcloud CVE-2026-110447 Exposure Check — Free 30-Second Self-Test
One thing worth stressing: if you were running a vulnerable version while the CODE server was down for any reason (restart/upgrade/crash), patch alone isn’t enough — hunt for unexpected PHP files first. Web shells were found on real servers.