ownCloud Auth Bypass CVE-2023-49105 Added to CISA KEV After Nuclear-Data Theft

On August 27, 2026, CISA added CVE-2023-49105 — an authentication bypassAuthentication Bypass📖A security vulnerabilityVulnerability🛡️A weakness in software, hardware, or processes that can be exploited by attackers to gain unauthorized access or cause harm. that allows an attacker to circumvent the login verification process and gain unauthorized access to a system without providing valid credentials. in ownCloud Server — to its Known Exploited Vulnerabilities (KEV) catalog, with a remediation deadline of August 30 for federal civilian agencies. The entry stands out on two counts. The flaw is nearly two years old, and it reached the catalog only after researchers caught it being used to exfiltrate sensitive files from a national nuclear-research organization.

What Happened

CVE-2023-49105 carries a CVSS v3.1 base score of 9.8 and is classified as improper authentication (CWE-287). It affects ownCloud Server versions 10.6.0 through 10.13.0 — the self-hosted, PHP-based file-sync-and-share product. ownCloud states that Infinite Scale and its managed offerings are not affected. The bug was originally disclosed and patched in late 2023 as part of a trio of ownCloud advisories, but it sat outside the KEV catalog until confirmed in-the-wild abuse forced the listing under CISA's binding directive for known-exploited flaws.

The trigger was an intrusion uncovered by researchers at Hunt.io, who found an exposed attacker-controlled server at 31.58.209[.]241 in Amsterdam and reported the findings to CERT-PH. The exposed logs described a targeted campaign against a Philippine nuclear-research organization and a marine engineering and shipbuilding company supporting the Philippine Navy. Roughly 9 GB of data was exfiltrated, including nuclear material records, research-reactor core-component databases, radiation-safety documentation, fuel-inventory records, personnel files, passports, and travel records. The activity was discovered on August 13, 2026, and publicly disclosed on August 25. Researchers assessed it as targeted intelligence collection by suspected Chinese-speaking operators rather than opportunistic scanning, and did not attribute it to a named group.

Technical Analysis

The vulnerability lives in ownCloud's handling of pre-signed URLs on the WebDAV API. A pre-signed URLSigned URL🛡️A URL that carries a cryptographic signature over its parameters, granting the holder a specific, time-limited action without a login session. The server recomputes the signature to verify the request is authentic and unmodified. is supposed to carry a cryptographic signatureCryptographic Signature📖A mathematical scheme that uses public key cryptography to verify the authenticity and integrity of digital data, ensuring the content has not been altered and was created by the claimed sender. that the server recomputes and compares before granting access. In the affected releases, when the target user account has no signing-key configured, the validation logic fails open: instead of rejecting a request that cannot be verified, it accepts it. An attacker who knows or can enumerate a valid username can therefore craft forged WebDAV requests that the server treats as authenticated, then read, modify, or delete that user's files without any credentials.

That fail-openFail-Open🛡️A design flaw in which a control that cannot complete its check grants access instead of denying it. In authentication, a missing key or failed lookup that results in access being allowed turns a security check into a rubber stamp. behavior is what turns a missing configuration value into a pre-authentication compromise, and it is why the exploited deployments had no signing secret set. Anyone unclear on how these signatures are meant to be generated and checked will find a full walkthrough in How Signed-URL Authentication Works, which explains why a missing key should always be treated as a hard failure rather than a pass. In the observed campaign, the attackers throttled their Python tooling with random 1.5-to-6-second delays between requests to stay under rate-based detection thresholds — a reminder that low-and-slow exfiltration defeats naive volume alerting.

Why an Old Bug Resurfaced Now

CVE-2023-49105 was one of three ownCloud flaws disclosed together in late 2023, alongside a GraphAPI information-disclosure issue and a subdomain-validation bypass. Administrators who patched the headline GraphAPI bug at the time did not necessarily address the WebDAV signing-key problem, because the three required different remediation steps. That partial-patching pattern is part of why vulnerable instances are still reachable nearly two years later. A KEV listing is not a statement that a flaw is new; it is a statement that someone is actively using it right now, which is why a 2023 CVE can carry a three-day federal clock in 2026.

Who Is Affected

Any organization still running ownCloud Server between 10.6.0 and 10.13.0 is exposed, and the risk is acute for internet-reachable instances with predictable usernames — email-address logins, sequential accounts, or directory-synced names all make enumeration trivial. Because exploitation needs only a username and network reachability, an exposed instance behind no additional controls is a single request away from unauthenticated file access. If you are not certain what file-sync or file-sharing servers your organization exposes to the internet, How to Audit Internet-Exposed File-Sharing Servers walks through building that inventory before an attacker builds it for you.

The stakes scale with what the server holds. In the Philippine case the exposed data included reactor core-component records and radiation-safety documentation — material whose loss matters far beyond the IT department. Any ownCloud instance storing regulated, proprietaryProprietary📖Software owned by a company with restricted access to source code., or safety-critical files should be treated as a priority regardless of how obscure the deployment feels, because the observed campaign was deliberately hunting for exactly that kind of high-value target rather than spraying the internet at random.

Immediate Actions

Upgrade ownCloud Server to a fixed release. ownCloud's own advisory directs administrators to version 10.13.3 and to configure a strong signing secret; some vulnerability databases list the fix as arriving in 10.13.1, so treat 10.13.3 as the safe target and confirm against your specific build. Where an immediate upgrade is not possible, ensure every account has a signing-key configured, since the exploitExploit🛡️Code or technique that takes advantage of a vulnerability to cause unintended behavior, such as gaining unauthorized access. depends on that value being absent, and restrict the WebDAV endpoint to trusted networks.

Assume exposed instances may already be compromised. Review WebDAV access logs for unauthenticated file operations, requests referencing valid usernames without a corresponding login, and slow, evenly paced request patterns consistent with throttled exfiltration. Rotate any credentials or key material that lived in accessible storage. Teams that need a repeatable process for turning a fresh KEV entry into containment steps can follow How to Triage a CISA KEVCISA KEV🛡️The Known Exploited Vulnerabilities catalog maintained by CISA, listing vulnerabilities actively exploited in attacks that federal agencies must patchPatch🛡️A software update that fixes security vulnerabilities, bugs, or adds improvements to an existing program. by specific deadlines. Addition in 72 Hours, which maps the KEV deadline to concrete owner assignments.

Long-Term Outlook

The deeper lesson is not about one PHP application. ownCloud Server is a legacy product line that many organizations kept running long after the vendor steered customers toward Infinite Scale, and this campaign shows how a dormant, unpatched, internet-facing service becomes a standing liability the moment a public exploit and a motivated actor line up. A two-year-old bug earned a three-day federal remediation clock because it was quietly weaponized against critical research infrastructure. Building a disciplined plan for retiring or isolating aging software — the subject of Why End-of-Life Software Is a Standing Breach Risk — is what keeps the next old CVE from becoming your incident.

Sources

• https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
• https://owncloud.com/blogs/immediate-action-required-critical-security-updates-for-owncloud/
• https://gbhackers.com/cve-2023-49105-flaw-exploited/
• https://www.sentinelone.com/vulnerability-database/cve-2023-49105/