CISA Adds ownCloud Flaw CVE-2023-49105 to KEV After Philippine Nuclear Records Theft

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical ownCloud vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on Aug. 27, 2026, after a Chinese-speaking threat actor used it to steal nuclear records from a research body in the Philippines. The flaw, CVE-2023-49105 (CVSS score 9.8), is a WebDAV API authentication bypass in the ownCloud file-sharing platform.

The detail worth pausing on is the year in the identifier. This is a 2023 bug, disclosed and fixed almost two years before it turned up in an intrusion against nuclear infrastructure. The gap between when the patch shipped and when the flaw was weaponized is the part of this story a defender can actually do something about, and it is a patch-management problem long before it is an espionage one.

A 2023 Flaw, Added to KEV in 2026

A KEV listing is not a discovery. It is CISA's confirmation that a vulnerability is being exploited in the wild, which turns a theoretical risk into a dated to-do. CISA added CVE-2023-49105 to the catalog on Thursday alongside two other flaws, and Federal Civilian Executive Branch (FCEB) agencies are directed to apply the fix by Aug. 30, 2026.

The vulnerability itself is a WebDAV API authentication bypass. According to ownCloud's own advisory, it lets an attacker access, modify, or delete any file without authentication if the target's username is known and the account has no signing key configured, which is the default state. ownCloud disclosed the issue in November 2023. It affects "core" versions 10.6.0 through 10.13.0 and was fixed in version 10.13.1. In other words, a patched, up-to-date ownCloud instance was never exposed to this. The victims here were running something older, or misconfigured, or both.

What Hunt.io Found in an Open Directory

The KEV addition followed research from threat intelligence firm Hunt.io, which identified an exposed directory on an attacker-controlled host that staged custom Python scripts, open-source offensive tooling, and data exfiltrated from two Philippine organizations. One was a nuclear research body. The other was a marine engineering and shipbuilding company that provides services to the Philippine Navy.

Five custom Python scripts in that directory implemented the CVE-2023-49105 exploit against the nuclear body's ownCloud server. "The scripts targeted an ownCloud instance operated by a nuclear research body, using pre-signed URLs generated with an empty signing secret, which allowed for the unauthenticated retrieval of files over WebDAV," Hunt.io said. That empty signing secret is the default-configuration detail from the advisory, and it is the single most useful thing in this report for anyone running ownCloud: the exploit turns on a setting a defender can check.

By Hunt.io's estimate, the actor downloaded about 176 files, roughly 372 MB, from the nuclear entity, sorted across five staging directories. The material Hunt.io describes is exactly what you would not want an adversary reading: nuclear-material account records, draft strategic plans covering 2023 through 2028, research reactor core component data, historical fuel inventories, and employee personal information. It also included a 192 MB database dump from a ZKTeco BioTime attendance and personnel system, and, most consequential for blast radius, credential stores: BitLocker keys, a KeePass database, and AxCrypt-encrypted files. Stolen key material does not stay contained to one server, which is why a file-server breach can become an identity breach.

The second intrusion did not touch ownCloud at all. Hunt.io ties the marine engineering firm's compromise to a known critical flaw in the LiteSpeed Cache plugin for WordPress (CVE-2024-28000, also CVSS 9.8), plus a brute-force script aimed at the same site's XML-RPC endpoint. Two victims, two intrusion paths, and in both cases the way in was a publicly documented vulnerability with a patch already available.

On attribution, Hunt.io is careful. It ties the operator to a Chinese speaker based on simplified Chinese in the source-code comments, docstrings, log output, and the folder names used to sort stolen data. It does not put a familiar group label on the activity. "The operator, whether state-affiliated, contracted, or working independently, conducted a deliberate intrusion against Philippine nuclear and defense-adjacent organizations," the firm said, adding that the marine firm's Navy ties "align with interests tied to current South China Sea tensions."

The Pattern: Known CVEs Are the Nation-State Highway

The most instructive thing about this campaign is how unexotic the entry points were. No zero-day, no novel exploit chain. An operator pursuing nuclear and defense-adjacent targets in the Philippines got in through a 2023 file-sharing bug and a 2024 WordPress plugin flaw, both of which had patches on the shelf. The tradecraft that mattered was not breaking cryptography. It was finding the servers that nobody had gotten around to updating.

That fits a thread running through recent China-nexus disclosures. It is the same reliance on already-known weaknesses that Cisco Talos documented when it tied a Chinese-speaking crew to a 170,000-URL target list of vulnerable web servers, and it sits alongside the contractor-and-proxy model U.S. prosecutors described when the FBI and Justice Department seized the QScan and QTRouter platforms tied to the group QTFY. The tooling and the attribution change from case to case. The unpatched, internet-facing server does not. This is why vulnerability management, and specifically the discipline of treating a KEV entry as a hard deadline, does more to blunt nation-state intrusions than most threat-hunting programs. For an organization running a research reactor, it is also squarely a matter of critical-infrastructure security.

My read: the "nuclear records stolen by China" framing is what will travel, but the durable lesson is duller and more useful. A 2023 CVE-ID on a fresh KEV entry is a written record that "we patched that" is a claim, not a fact, until someone checks the running build. This is an assessment rather than a reported finding, but the pattern is hard to miss: sophisticated actors keep choosing the cheapest door, and the cheapest door is a service that was fixed years ago and never updated. The organizations that avoid becoming the next Hunt.io write-up are not the ones with the most detection tooling. They are the ones that can answer, today, which of their internet-facing services are actually on the patched version.

What ownCloud Operators Should Verify

The response to this disclosure is concrete, and it starts with confirming an assumption rather than trusting it. Because CVE-2023-49105 is old, the most common failure mode is believing it was handled. Work the list below in order.

An ownCloud operator checklist for CVE-2023-49105, in priority order. Source: CISA KEV entry and Hunt.io analysis.

Concretely: confirm every ownCloud instance is on 10.13.1 or later rather than assuming the 2023 fix was applied, and check that a signing key is actually configured, since the exploit depends on the empty default. Review WebDAV access logs for unauthenticated retrievals and bulk downloads. Pull internet-facing instances behind a VPN or allowlist where the workflow allows it. And if you find evidence of unauthenticated pulls, treat it as a live incident: preserve the logs, and rotate any credentials or key material that lived in the exposed files, because on the evidence here those stores were a collection target.

What the Sources Don’t Name

Several details in circulation around this story are not established, and they are worth stating plainly. Neither CISA nor Hunt.io names the nuclear research body. The Philippine Nuclear Research Institute is the country's only nuclear research organization and operates its lone research reactor, which makes it the obvious candidate, but the sources decline to identify the victim, so treat any specific name as inference rather than confirmation.

The actor is not identified beyond "Chinese-speaking." Hunt.io explicitly leaves open whether the operator is state-affiliated, contracted, or independent, and attaches no APT designation, so labels like APT41 or a specific typhoon cluster are not supported by what has been published. The 176-file, 372 MB figure is Hunt.io's estimate reconstructed from the staged data, not an official damage assessment from the Philippine government. And while active exploitation indicates the targeted instance was not on the fixed version, or was running the default empty signing-key configuration, the sources do not state the victim's exact patch level. Weigh follow-on reporting that fills these gaps against what the primary documents actually say.

Primary Documents

• CISA: CISA Adds Three Known Exploited Vulnerabilities to Catalog (Aug. 27, 2026)
• CISA Known Exploited Vulnerabilities Catalog
• ownCloud security advisory: WebDAV API authentication bypass using pre-signed URLs
• CVE-2023-49105 record (CVSS 9.8)
• Hunt.io: Chinese-Speaking Operator Targets Philippine Nuclear and Naval Contractor
• The Hacker News: ownCloud Flaw Exploited to Steal Nuclear Records From Philippine Research Body (Aug. 28, 2026)