The Bug Was Three Years Old. Attackers Could Still Treat ownCloud as Their File System.
CISA says attackers are exploiting a critical ownCloud Server flaw disclosed in 2023. Where a vulnerable account lacks a signing key, knowing its username can be enough to turn a supposedly pre-signed WebDAV URL into unauthenticated file access.
The vulnerability, CVE-2023-49105, was added to the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalogue on 27 August 2026. Federal civilian agencies have until 30 August to remediate it, an unusually short deadline that reflects the risk CISA assigns to the observed exploitation.
CISA has not identified the attackers, named victims, described payloads or linked the activity to ransomware. That evidentiary limit matters. What is confirmed is exploitation of the vulnerability, not a particular campaign narrative.
A signature check with nothing to verify
The affected ownCloud Server feature creates pre-signed WebDAV URLs. These links are intended to give controlled access to a file without requiring the recipient to complete a normal interactive login. Their security depends on a signing key that lets the server distinguish an authorised link from one an attacker fabricated.
In the vulnerable condition, a user account has no signing key configured. An attacker who knows that user’s name can construct a request that passes the flawed validation path. According to the vulnerability description, this can permit unauthenticated access, modification or deletion of any file available to the victim account.
This is more consequential than a link leak. It is a trust-boundary failure in which the server accepts a URL as signed even though the account has no secret with which a meaningful signature could have been produced. The result is file-system access through the permissions of a legitimate user.
Public exploit material shortens the path
Public proof-of-concept material has existed for some time. ProjectDiscovery maintains a Nuclei template that builds a pre-signed request with an empty signing key and tests the WebDAV endpoint. Other public repositories demonstrate the same primitive.
That does not prove every public scanner is being used maliciously, but it removes much of the research burden. Once a vulnerable host and a usable username are available, the request pattern is no longer difficult to reproduce. CISA’s exploitation confirmation changes the operational question from whether the flaw is practical to whether exposed systems were patched before attackers reached them.
The version guidance needs careful reading
NVD describes ownCloud core versions before 10.13.1 as affected. ownCloud’s broader December 2023 security notice, however, told administrators that all ownCloud Server instances below 10.13.3 should be treated as affected by the bulletin and that the WebDAV authentication-bypass fix required 10.13.3 or a specific support patch.
Defenders should follow the vendor’s broader guidance. Version 10.13.3 is the historical minimum named for this flaw, not a sensible upgrade destination in 2026. Administrators should move to a currently supported release and confirm with ownCloud or their distribution that the fix is present.
ownCloud Infinite Scale and managed services including ownCloud.Online were not affected by this Server vulnerability, according to ownCloud. The distinction is important when inventory names are ambiguous. Teams should identify the actual product and deployment model, not assume that every service carrying the ownCloud name has the same exposure.
What defenders should do now
- Find every ownCloud Server instance. Include test systems, disaster-recovery nodes, appliances and servers published through a reverse proxy.
- Confirm the product and build. Separate ownCloud Server from Infinite Scale and managed ownCloud services. Do not infer safety from a hostname or user interface alone.
- Upgrade to a supported fixed release. If a direct upgrade is not immediately possible, obtain the specific vendor patch and restrict external access until it is applied.
- Review signing-key state. Identify accounts without signing keys, but do not treat correcting that configuration as a substitute for patching.
- Hunt for suspicious WebDAV activity. Review requests to pre-signed WebDAV paths, especially requests tied to unusual source addresses, unexpected usernames, bulk downloads, modifications or deletions.
- Protect the data, not only the server. Verify backups, check whether files were altered and consider the sensitivity of every repository accessible to a potentially affected account.
Where logs are incomplete, absence of evidence is not evidence of absence. A successful request may look like ordinary file activity because the vulnerable server itself authorises it. Correlating WebDAV logs with identity records, network telemetry and file-change history will provide a stronger answer than any one log source.
The old ownCloud flaw reached a Philippine nuclear agency
Hunt.io has now documented campaign evidence that gives the exploitation a concrete victim and collection objective. On 13 August 2026, researchers found an exposed attacker staging server containing five custom Python scripts, transfer logs and stolen material tied to an internet-facing ownCloud deployment used by a Philippine nuclear research organisation.
The scripts implemented CVE-2023-49105 with an empty signing secret, impersonated named accounts and used WebDAV requests to enumerate and retrieve files. Random delays slowed the collection, while Chinese-language comments and folder names categorised material by subjects including nuclear-material accounts, radiation safety, finance and IT planning.
The exposed server held 176 files totalling about 372 MB. A separate attacker-created CSV recorded roughly 9 GB as exfiltrated, suggesting that the recovered directory represented only part of the operation. Visible material included research-reactor core-component records, fuel inventories, radiation-safety documents, strategic plans, personnel files, passport-related records, a KeePass database, AxCrypt-protected files and a BitLocker recovery key.
This changes the defender picture. The vulnerability was not being used merely to test access or pull random files. The scripts selected accounts and subject areas, then collected slowly enough to reduce the chance of volume-based detection.
A naval contractor was compromised through a second path
The same staging server also contained evidence from a Philippine marine-engineering and shipbuilding company that provides services to the country’s Navy. The operator used CVE-2024-28000, an unauthenticated privilege-escalation flaw in the LiteSpeed Cache WordPress plugin, to create an administrator account after brute-forcing the plugin’s weakly generated security hash.
A separate XML-RPC password-guessing tool also recovered working credentials. Three archives on the staging server contained the WordPress installation, its database and the full media library. Hunt.io also found a separate EtherHiding-style compromise on the site, but says the available evidence does not link that activity to the ownCloud operator.
Hunt.io assesses with medium confidence that the activity reflects targeted collection by a Chinese-speaking operator. It does not attribute the campaign to a named group or establish state sponsorship. The language evidence, victim selection and organised collection are meaningful, but they do not support a stronger attribution claim on their own.
Defenders should add low-rate WebDAV enumeration, repeated pre-signed requests across multiple accounts and access to credential stores or travel records to their hunt logic. WordPress administrators should also update LiteSpeed Cache to version 6.4 or later, restrict XML-RPC where it is unnecessary and investigate newly created administrator accounts.
The larger lesson is patch debt
CVE-2023-49105 is not new. It was disclosed almost three years before CISA added it to KEV. That gap is the story: exploitation often arrives long after an advisory has left the news cycle, while forgotten servers and delayed upgrades remain reachable.
For file-sharing systems, the cost of delay is not limited to host compromise. The application may already contain contracts, credentials, personal data and operational documents. A flaw that lets an attacker act through a legitimate user’s file permissions can turn old patch debt directly into a confidentiality, integrity and recovery problem.
Sources and further reading
- CISA Known Exploited Vulnerabilities Catalog, catalogue update released 27 August 2026 at 17:00 UTC
- ownCloud: Immediate Action Required, Critical Security Updates for ownCloud, published 1 December 2023, no publication time provided
- NVD entry for CVE-2023-49105, received 21 November 2023 at 17:15 UTC
- ProjectDiscovery Nuclei template for CVE-2023-49105
- Hunt.io: Philippine Nuclear Agency and Naval Contractor Targeted by Suspected Chinese-Speaking Operator, published 26 August 2026. The primary page provides no publication time.
