CISA says attackers are exploiting a critical ownCloud WebDAV authentication bypass first disclosed in 2023. A known username and a missing signing key can expose a user's files without authentication.